CVE-2025-32433 is a missing-authentication-for-critical-function flaw (CWE-306) in the SSH server of Erlang/OTP: by exploiting how the implementation handles SSH protocol messages, a remote attacker can execute arbitrary commands without any valid credentials, and because Erlang/OTP's SSH server is embedded in numerous third-party products (including Cisco, NetApp and SUSE software), the practical blast radius extends well beyond people who run Erlang directly.
Vulnerability summary
10
Critical
98.9%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-04-16
Published
Vulnerability ID: CVE-2025-32433 · Source: GitHub Security Advisories (CNA Secondary score; NVD has not published its own Primary CVSS as of this check — not NVD-confirmed). Confirmed present in the live CISA KEV catalog.
Affected components
| Component | CPE | Version range |
|---|---|---|
| Erlang/OTP (ssh application) | cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* | Before OTP-25.3.2.20, OTP-26.2.5.11, and OTP-27.3.3 (ssh library before 5.2.10 / 5.1.4.8 / 4.15.3.12); any OTP version running the ssh application's SSH server is potentially affected |
| Downstream products bundling the vulnerable Erlang/OTP SSH server (e.g. Cisco ConfD Basic, Cisco Network Services Orchestrator, Cisco RV160/RV260/RV340/RV345 series routers) | cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* | Cisco ConfD Basic before 7.7.19.1/8.1.16.2/8.2.11.1/8.3.8.1/8.4.4.1 and Network Services Orchestrator before corresponding fixed releases, per Cisco's own advisory and NVD's recorded configurations; other OTP-embedding vendors (NetApp, SUSE, Debian) are separately affected per CISA KEV notes |
What this means
CVE-2025-32433 is a missing authentication for critical function vulnerability (CWE-306) in Erlang/OTP, the open-source runtime and library set for the Erlang programming language used heavily in telecom, messaging (e.g. RabbitMQ, parts of WhatsApp's backend) and network-equipment control planes. The GitHub Security Advisory from the Erlang/OTP maintainers states: "a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials" (Erlang/OTP GHSA-37cp-fgq5-7wc2).
The maintainers rate it CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the maximum possible base score. As of this check, NVD's own vulnerability-status field is "Analyzed" (NVD has added CPE/configuration data) but NVD has not published its own independent Primary CVSS metric for this CVE; the only score on record is the GitHub (CNA) Secondary submission above, so per our indexing policy that 10.0 figure is labelled not NVD-confirmed rather than attributed to NVD (NVD). This page remains indexed because the CVE is independently, genuinely present in the live CISA KEV catalog (verified by matching the exact CVE ID string in the raw KEV JSON feed, not a summarized view) — not on the strength of an NVD-confirmed score.
The fix lands in OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 (ssh library 5.2.10 / 5.1.4.8 / 4.15.3.12). Until upgrading, the advisory's stated workaround is to either disable the SSH server entirely or restrict access to it via firewall rules (Erlang/OTP GHSA-37cp-fgq5-7wc2).
CISA added CVE-2025-32433 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-06-09, due date 2025-06-30, with known ransomware-campaign use listed as "Unknown." CISA's own enrichment (SSVC) flags the exploitation status as "active," the bug as "automatable," and the technical impact as "total." The KEV entry specifically calls out that this "vulnerability affects a common open-source project, third-party library, or a protocol used by different products," naming Cisco, NetApp and SUSE as examples of vendors shipping affected Erlang/OTP builds (CISA KEV). Cisco's own advisory confirms ConfD Basic, Network Services Orchestrator, and several other Cisco products that embed Erlang/OTP's SSH server as affected, with fixes tracked separately per product line (Cisco Security Advisory cisco-sa-erlang-otp-ssh-xyZZy).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.98924 (99.928th percentile) — one of the highest EPSS scores observed, consistent with a trivially scriptable, maximum-severity, actively-exploited pre-auth RCE in widely embedded software (FIRST EPSS).
Any system running an Erlang/OTP SSH server — whether a direct Erlang deployment or embedded inside a third-party product — should be upgraded to a patched OTP/ssh release immediately; where patching isn't yet possible, disable the SSH server or firewall it off from untrusted networks.
Evidence
- A flaw in SSH protocol message handling in the Erlang/OTP SSH server allows an attacker to perform unauthenticated remote code execution. — Erlang/OTP GHSA-37cp-fgq5-7wc2
- CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted by GitHub as a CNA Secondary score; NVD's vulnStatus is Analyzed but NVD has not published its own Primary CVSS as of this check. — NVD
- Fixed in OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20; workaround is to disable the SSH server or restrict access via firewall rules. — Erlang/OTP GHSA-37cp-fgq5-7wc2
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-06-09, due date 2025-06-30; CISA SSVC enrichment marks exploitation as active, automatable, with total technical impact. Products from Cisco, NetApp and SUSE that embed Erlang/OTP are named as affected. — CISA KEV
- EPSS score is 0.98924 (99.928th percentile) as of 2026-10-29. — FIRST EPSS
