Skip to main content

Erlang Otp CVE-2025-32433

CRITICAL
Missing Authentication for Critical Function (CWE-306)
2025-04-16 security-advisories@github.com
RCE Authentication Bypass Erlang Otp Confd Basic Network Services Orchestrator Cloud Native Broadband Network Gateway Inode Manager Smart Phy Ultra Packet Core Ultra Services Platform Staros Optical Site Manager Ncs 2000 Shelf Virtualization Orchestrator Firmware Enterprise Nfv Infrastructure Software Ultra Cloud Core Rv160W Firmware Rv260 Firmware Rv160 Firmware Rv260P Firmware Rv260W Firmware Rv340 Firmware Rv340W Firmware Rv345 Firmware Rv345P Firmware Debian Linux Suse
10.0
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SUSE
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Mar 28, 2026 - 18:37 vuln.today
Patch released
Mar 28, 2026 - 18:37 nvd
Patch available
Added to CISA KEV
Nov 04, 2025 - 14:49 cisa
CISA KEV
PoC Detected
Nov 04, 2025 - 14:49 vuln.today
Public exploit code
CVE Published
Apr 16, 2025 - 22:15 nvd
CRITICAL 10.0

DescriptionGitHub Advisory

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

AnalysisAI

Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling, enabling unauthorized system access with CVSS 10.0.

Technical ContextAI

The CWE-306 flaw in SSH protocol message handling allows an attacker to send SSH messages before authentication completes. The SSH server processes these pre-auth messages in a way that enables arbitrary Erlang code execution, which translates to OS command execution.

RemediationAI

Update Erlang/OTP immediately. Identify all services using Erlang SSH (RabbitMQ, CouchDB, ejabberd, etc.). Restrict SSH port access. Monitor for exploitation attempts.

More in Erlang Otp

View all
CVE-2017-1000385 MEDIUM POC
5.9 Dec 12

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Rat
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2014-1693 HIGH POC
7.5 Dec 08

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inje
CVE-2021-29221 HIGH POC
7.0 Apr 09

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. Rated high severity (CV
CVE-2016-10253 CRITICAL
9.8 Mar 18

An issue was discovered in Erlang/OTP 18.x. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-37026 CRITICAL
9.8 Sep 21

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in
CVE-2026-42790 HIGH
7.6 May 27

TLS server impersonation in Erlang/OTP's public_key library lets a name-constrained subordinate CA forge a trusted ident
CVE-2020-25623 HIGH
7.5 Oct 02

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. Rated high severity (CVSS 7.5), this

CVE-2026-42789 HIGH
7.0 May 27

Certificate chain forgery in Erlang/OTP's public_key application (pubkey_cert module) lets a non-CA end-entity certifica
CVE-2026-42791 MEDIUM
6.3 May 27

OCSP responder certificate validity bypass in Erlang OTP's public_key library allows forged OCSP responses-signed with t
CVE-2015-2774 MEDIUM
5.9 Apr 07

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2016-2004 CRITICAL POC
9.8
CVE-2024-46506 CRITICAL POC
10.0
CVE-2025-8943 CRITICAL POC
9.8
CVE-2014-4872 HIGH POC
7.5

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

Share

CVE-2025-32433 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy