Erlang/OTP SSH Vulnerability Sees Spike in Exploitation Attempts
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32433 | Unauthenticated RCE in Erlang/OTP SSH Server CVE-2025-32433 is a missing-authentication flaw (CWE-306) in the SSH server shipped with Erlang/OTP, the runtime and libraries of the Erlang programming language. An unauthenticated attacker can send specially crafted SSH protocol messages to a vulnerable Erlang/OTP SSH daemon before authentication and trigger remote code execution. Successful exploitation yields arbitrary command execution on the host with the privileges of the SSH service, and the CVSS scope change (S:C) indicates compromise can cascade to resources beyond the vulnerable component. Affected are any systems exposing the Erlang/OTP SSH server, including standalone Erlang deployments, Debian-packaged Erlang, and Cisco products that embed Erlang/OTP (e.g., Network Services Orchestrator, ConfD Basic, Ultra Packet Core). Exploitation is confirmed in the wild: a public proof-of-concept exists, the bug was added to CISA KEV on 2025-06-09, and researchers report a surge in exploitation attempts, with roughly 70% of observed attacks targeting OT firewalls. Do: Upgrade Erlang/OTP to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 depending on the release branch, and apply the corresponding updates from Cisco and Debian for embedded/packaged Erlang. Until patched, disable the Erlang SSH daemon or restrict access to it with firewall rules, prioritizing internet-exposed hosts and OT firewall devices where ~70% of observed attacks have landed. Federal agencies must apply mitigations per vendor instructions under the KEV/BOD 22-01 requirements. | 10.0 | 99% | KEV PoC |
| largetens of thousands of internet-exposed Erlang/OTP SSH servers, plus an unknown additional embedded installed base in telecom/network equipment (Cisco NSO,… |
Full article414 words · extracted from infosecurity-magazine.com · click to collapse
A severe remote code execution (RCE) vulnerability in Erlang’s Open Telecom Platform (OTP) Secure Shell daemon (sshd) is being actively exploited.
According to a new analysis by Palo Alto’s Unit 42, CVE-2025-32433, rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute commands by sending specific SSH messages before authentication.
Vulnerable versions include Erlang/OTP releases before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20.
Surge in Targeted Attacks
Between May 1 and May 9, the researchers observed a surge in exploitation attempts, with 70% of detections originating from firewalls protecting operational technology (OT) networks.
Many targeted sectors rely on Erlang/OTP’s native SSH for remote administration, including healthcare, agriculture, media and entertainment and high technology.
“This vulnerability, if exploited, could have severe consequences on the organization, their network and operations,” said Thomas Richards, infrastructure security practice director at Black Duck.
“The attacker would have full control over the system, which can result in a compromise of sensitive information and allow them to compromise additional hosts within the network.”
Erlang/OTP services were found to be widely exposed on the internet, sometimes over industrial ports like TCP 2222, creating a crossover risk between IT and industrial control systems. The US, Brazil and France host the highest number of exposed services.
Exploitation Details and Mitigation
Attackers have been observed deploying payloads that establish reverse shells for unauthorized access.
One method binds a shell to a TCP connection, while another redirects Bash input and output to a remote host linked to botnet command servers. Some payloads utilize DNS callbacks to track execution without returning results – a tactic commonly employed in stealthy campaigns.
“The real danger with CVE-2025-32433 is that it’s not just an IT vulnerability: it is disproportionately affecting [OT] networks, and it’s already actively showing up in systems tied to critical infrastructure.” said April Lenhard, principal product manager at Qualys.
According to Lenhard, exploitation could “alter sensor readings, trigger outages, introduce safety risks and cause physical damage.”
While education accounted for 72.7% of all detections, many OT-heavy sectors like utilities, mining and aerospace saw no recorded OT triggers, possibly due to segmentation, delayed targeting or gaps in detection.
Researchers urge organizations to patch immediately, upgrading to OTP 27.3.3, OTP 26.2.5.11 or OTP 25.3.2.20. Temporary measures include disabling the SSH server or restricting access via firewall rules.
“Addressing this vulnerability should be a top priority for any security team responsible for an OT network,” Richards concluded.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/erlangotp-ssh-flaw-sees/