NetSight
IP …
critical10.0Known exploited

CVE-2025-32433

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-06-09. Federal due date: 2025-06-30.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Affected products

VendorProductAffected versions
ErlangErlang\/Otp
before 25.3.2.20
from 26.0 before 26.2.5.11
from 27.0 before 27.3.3
CiscoConfd Basic
before 7.7.19.1
from 8.0.18 before 8.1.16.2
from 8.2 before 8.2.11.1
from 8.3 before 8.3.8.1
from 8.4 before 8.4.4.1
CiscoNetwork Services Orchestrator
before 5.7.19.1
from 5.8 before 6.1.16.2
from 6.2 before 6.2.11.1
from 6.3 before 6.3.8.1
from 6.4 before 6.4.1.1
from 6.4.2 before 6.4.4.1
CiscoCloud Native Broadband Network Gateway
before 2025.03.1
CiscoInode Manager
All versions
CiscoSmart Phy
before 25.2
CiscoUltra Packet Core
before 2025.03
CiscoUltra Services Platform
All versions
CiscoStaros
before 2025.03
CiscoOptical Site Manager
before 25.2.1
CiscoNcs 2000 Shelf Virtualization Orchestrator Firmware
before 25.1.1
CiscoEnterprise Nfv Infrastructure Software
before 4.18

Weakness classification

CWE-306

References