NVD - CVE-2025-32433

7 min read Original article ↗

Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.


Metrics

 

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:


NIST CVSS score

NIST: NVD

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:


NIST CVSS score

NIST: NVD

Base Score:  N/A

NVD assessment not yet provided.


Nist CVSS score does not match with CNA score

CNA:  GitHub, Inc.

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
http://www.openwall.com/lists/oss-security/2025/04/16/2 CVE Mailing List 
http://www.openwall.com/lists/oss-security/2025/04/18/1 CVE Mailing List 
http://www.openwall.com/lists/oss-security/2025/04/18/2 CVE Mailing List 
http://www.openwall.com/lists/oss-security/2025/04/18/6 CVE Mailing List 
http://www.openwall.com/lists/oss-security/2025/04/19/1 CVE Mailing List 
https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py CISA-ADP Exploit 
https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 GitHub, Inc. Patch 
https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f GitHub, Inc. Patch 
https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 GitHub, Inc. Patch 
https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 GitHub, Inc. Vendor Advisory 
https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html CVE Third Party Advisory 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy CISA-ADP Third Party Advisory 
https://security.netapp.com/advisory/ntap-20250425-0001/ CVE Third Party Advisory 
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433 CISA-ADP US Government Resource 

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name Date Added Due Date Required Action
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability 06/09/2025 06/30/2025 Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-ID CWE Name Source
CWE-306 Missing Authentication for Critical Function GitHub, Inc.  

Known Affected Software Configurations Switch to CPE 2.2

Change History

19 change records found show changes

Modified Analysis by NIST 11/04/2025 9:49:05 AM

Action Type Old Value New Value
Added CPE Configuration 
OR
          *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Added Reference Type 
CVE: https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html Types: Third Party Advisory

CVE Modified by CVE 11/03/2025 3:18:27 PM

Action Type Old Value New Value
Added Reference 
https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html

Modified Analysis by NIST 10/24/2025 10:48:43 AM

Action Type Old Value New Value
Added Reference Type 
CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433 Types: US Government Resource

CVE Modified by CISA-ADP 10/21/2025 7:16:59 PM

Action Type Old Value New Value
Added Reference 
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433

CVE Modified by CISA-ADP 10/21/2025 4:20:34 PM

Action Type Old Value New Value
Removed Reference 
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433

CVE Modified by CISA-ADP 10/21/2025 3:21:15 PM

Action Type Old Value New Value
Added Reference 
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433

Modified Analysis by NIST 7/30/2025 3:24:19 PM

Action Type Old Value New Value
Changed CPE Configuration 
OR
          *cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:* versions up to (excluding) 25.2
          *cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:ultra_packet_core:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03.1
 
OR
          *cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:* versions up to (excluding) 25.2
          *cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*
          *cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03
          *cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03.1
          *cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03
Added Reference Type 
CISA-ADP: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy Types: Third Party Advisory

CVE Modified by CISA-ADP 7/29/2025 10:17:35 PM

Action Type Old Value New Value
Added Reference 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy

Reanalysis by NIST 6/12/2025 12:05:19 PM

Action Type Old Value New Value
Added CPE Configuration 
AND
     OR
          *cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:* versions up to (excluding) 25.2.1
     OR
          cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*
          cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*
          cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 25.1.1
     OR
          cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*
Added CPE Configuration 
AND
     OR
          *cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*
Added CPE Configuration 
OR
          *cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* versions up to (excluding) 7.7.19.1
          *cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.18 up to (excluding) 8.1.16.2
          *cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* versions from (including) 8.2 up to (excluding) 8.2.11.1
          *cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* versions from (including) 8.3 up to (excluding) 8.3.8.1
          *cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* versions from (including) 8.4 up to (excluding) 8.4.4.1
Added CPE Configuration 
OR
          *cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:* versions up to (excluding) 4.18
          *cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03.1
Added CPE Configuration 
OR
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions up to (excluding) 5.7.19.1
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions from (including) 5.8 up to (excluding) 6.1.16.2
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.2.11.1
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.3 up to (excluding) 6.3.8.1
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.4 up to (excluding) 6.4.1.1
          *cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.4.2 up to (excluding) 6.4.4.1
Added CPE Configuration 
OR
          *cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:* versions up to (excluding) 25.2
          *cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:ultra_packet_core:-:*:*:*:*:*:*:*
          *cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:* versions up to (excluding) 2025.03.1

Initial Analysis by NIST 6/11/2025 5:15:21 PM

Action Type Old Value New Value
Added CPE Configuration 
OR
          *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions up to (excluding) 25.3.2.20
          *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.2.5.11
          *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 27.0 up to (excluding) 27.3.3
Added Reference Type 
CISA-ADP: https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py Types: Exploit
Added Reference Type 
CVE: http://www.openwall.com/lists/oss-security/2025/04/16/2 Types: Mailing List
Added Reference Type 
CVE: http://www.openwall.com/lists/oss-security/2025/04/18/1 Types: Mailing List
Added Reference Type 
CVE: http://www.openwall.com/lists/oss-security/2025/04/18/2 Types: Mailing List
Added Reference Type 
CVE: http://www.openwall.com/lists/oss-security/2025/04/18/6 Types: Mailing List
Added Reference Type 
CVE: http://www.openwall.com/lists/oss-security/2025/04/19/1 Types: Mailing List
Added Reference Type 
CVE: https://security.netapp.com/advisory/ntap-20250425-0001/ Types: Third Party Advisory
Added Reference Type 
GitHub, Inc.: https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 Types: Patch
Added Reference Type 
GitHub, Inc.: https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f Types: Patch
Added Reference Type 
GitHub, Inc.: https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 Types: Patch
Added Reference Type 
GitHub, Inc.: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 Types: Vendor Advisory

CVE CISA KEV Update by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government 6/09/2025 9:00:02 PM

Action Type Old Value New Value
Added Date Added 
2025-06-09
Added Due Date 
2025-06-30
Added Required Action 
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added Vulnerability Name 
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

CVE Modified by CVE 4/25/2025 7:15:16 PM

Action Type Old Value New Value
Added Reference 
https://security.netapp.com/advisory/ntap-20250425-0001/

CVE Modified by CISA-ADP 4/21/2025 1:15:24 PM

Action Type Old Value New Value
Added Reference 
https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py

CVE Modified by CVE 4/19/2025 12:15:14 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2025/04/19/1

CVE Modified by CVE 4/18/2025 10:15:13 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2025/04/18/6

CVE Modified by CVE 4/18/2025 2:15:53 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2025/04/18/2

CVE Modified by CVE 4/18/2025 1:15:33 AM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2025/04/18/1

CVE Modified by CVE 4/16/2025 6:15:14 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2025/04/16/2

New CVE Received from GitHub, Inc. 4/16/2025 6:15:14 PM

Action Type Old Value New Value
Added Description 
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Added CVSS V3.1 
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Added CWE 
CWE-306
Added Reference 
https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12
Added Reference 
https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f
Added Reference 
https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891
Added Reference 
https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2