ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Erlang/OTP

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

Erlang security advisory (AV26-870)

Canada's Cyber Centre warns that multiple Erlang/OTP versions are affected by vulnerabilities and urges administrators to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-870 on September 1, 2026, noting vulnerabilities affecting Erlang OTP across multiple versions. The bulletin contains no CVE identifiers or exploitation details and directs users and administrators to Erlang's own security advisories to apply necessary updates.

Canadian Centre for Cyber Security · 14d agoAdvisory

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42 · 29d agoExploit / PoC in the wildCVE-2025-32433

Related CVEs

  • CVE-2025-3243310.099%
    Unauthenticated RCE in Erlang/OTP SSH Server
    CVE-2025-32433 is a missing-authentication flaw (CWE-306) in the SSH server shipped with Erlang/OTP, the runtime and libraries of the Erlang programming language. An unauthenticated attacker can send specially crafted SSH protocol messages to a vulnerable Erlang/OTP SSH daemon before authentication and trigger remote code execution. Successful exploitation yields arbitrary command execution on the host with the privileges of the SSH service, and the CVSS scope change (S:C) indicates compromise can cascade to resources beyond the vulnerable component. Affected are any systems exposing the Erlang/OTP SSH server, including standalone Erlang deployments, Debian-packaged Erlang, and Cisco products that embed Erlang/OTP (e.g., Network Services Orchestrator, ConfD Basic, Ultra Packet Core). Exploitation is confirmed in the wild: a public proof-of-concept exists, the bug was added to CISA KEV on 2025-06-09, and researchers report a surge in exploitation attempts, with roughly 70% of observed attacks targeting OT firewalls.
    · Erlang/OTP (SSH server) all versions prior to OTP-27.3.3 (27.x), prior to OTP-26.2.5.11 (26.x), and prior to OTP-25.3.2.20 (25.x); fixed in those versions · cisco ConfD Basic KEV PoC large

Appears with

organization Canadian Centre for Cyber Security 1organization Unit 42 1product Cortex XDR 1product Cortex Xpanse 1product Erlang/OTP 1product Erlang/OTP SSH 1product Next-Generation Firewall 1vendor Palo Alto Networks 1vendor Watchtowr 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.