CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

• CWE-306

• https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12Patch
• https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892fPatch
• https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891Patch
• https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2Vendor Advisory
• https://www.openwall.com/lists/oss-security/2025/04/16/2Mailing List
• https://www.openwall.com/lists/oss-security/2025/04/18/1Mailing List
• https://www.openwall.com/lists/oss-security/2025/04/18/2Mailing List
• https://www.openwall.com/lists/oss-security/2025/04/18/6Mailing List
• https://www.openwall.com/lists/oss-security/2025/04/19/1Mailing List
• https://lists.debian.org/debian-lts-announce/2025/04/msg00028.htmlThird Party Advisory
• https://security.netapp.com/advisory/ntap-20250425-0001/Third Party Advisory
• https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.pyExploit
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZyThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433US Government Resource

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32428Jupyter Remote Desktop Proxy allows you to run a Linux Deskt…9
• CVE-2025-32429XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2025-3243A vulnerability was found in code-projects Patient Record Ma…8.8
• CVE-2025-32430XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2025-32431Traefik (pronounced traffic) is an HTTP reverse proxy and lo…9.1
• CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom d…10
• CVE-2025-32434PyTorch is a Python package that provides tensor computation…9.8
• CVE-2025-32435Hydra is a Continuous Integration service for Nix based proj…2.6
• CVE-2025-32436AutoGPT is a workflow automation platform for creating, depl…7.1
• CVE-2025-32437AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32438make-initrd-ng is a tool for copying binaries and their depe…8.8
• CVE-2025-32439pleezer is a headless Deezer Connect player. Hook scripts in…6.5