60
60
55
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.
CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.
90
57
60
60
55
55
57
55
30
55
30
55
60
60
55
60
55
30
55
60
55
60
55
60
55
60
60
55
Nozomi Compass helps industrial teams manage OT assets and vulnerabilities
Nozomi Networks launched Compass, an OT asset and vulnerability management platform unifying asset records, remediation workflows, and compliance evidence for industrial teams.
Nozomi Networks announced Compass, an OT asset and service management platform built on real-time first-party asset data from its Vantage cyber-physical security platform. It provides OT-native workflows, governed change approvals, consequence-based risk scoring, and continuous audit-ready compliance evidence mapped to NERC CIP, IEC 62443, NIS2, and TSA. The platform integrates with EAM, CMDB, ITAM, ITSM, SIEM, and SOAR tools and is designed to safely support AI-driven and agentic OT workflows with human oversight.
35
60
60
60
55
60
60
60
55