Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.
CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.
- Vulnerable Erlang/OTP versions precede OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20; patches available.
- Flaw lets unauthenticated SSH connection protocol messages trigger RCE before authentication.
- 70% of exploit detections occurred on OT firewalls; healthcare and agriculture hit hardest.
- Observed payloads deploy reverse shells and DNS-based OAST callbacks.
- Widely exposed Erlang/OTP SSH services include TCP port 2222 used by industrial automation.
- CVEs
- CVE-2025-32433
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-32433 | Unauthenticated RCE in Erlang/OTP SSH Server | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | watchtowr.com | s of long, randomly generated subdomains under dns.outbound.watchtowr[.]com : execSinet:gethostbyname("d0am3pi3pgl6h3t9mkp0qt3zn9p1iz |
| ipv4 | 146.103.40.203 | s the shell's input and output directly to a remote host at 146.103.40[.]203:6667 . This port is commonly associated with remote contr |
| ipv4 | 194.165.16.71 | ce . Indicators of Compromise .dns.outbound.watchtowr[.]com 194.165.16[.]71 146.103.40[.]203 Additional References RFC 4252 - The Sec |
From the original article
10 min read at unit42.paloaltonetworks.com
This article presents our observations of exploit attempts targeting CVE-2025-32433 . This vulnerability allows unauthenticated remote code execution (RCE) in the Secure Shell (SSH) daemon (sshd) from certain versions of the Erlang programming language's Open Telecom Platform (OTP). Erlang/OTP sshd is widely used in critical infrastructure and operational technology (OT) networks.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.