CVE-2025-32433 Erlang/OTP SSH RCE EXP

Description

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This could lead to compromise of said hosts, allowing for unauthorized access to and manipulation of sensitive data by third parties, or denial-of-service attacks.

Affected Versions

OTP-27.3.2 and earlier
OTP-26.2.5.10 and earlier
OTP-25.3.2.19 and earlier

Features

• Exploit Execution: Execute arbitrary commands.
• Reverse Shell: Initiate a bash-based reverse shell.

Usage

Execute a command:

cve-2025-32433.exe 127.0.0.1 -c 'id'
./cve-2025-32433.lnx 127.0.0.1 -c 'id'