CVE-2025-32433

Introduction

This document presents a study of the vulnerability CVE-2025-32433, affecting the built-in SSH server implementation in the Erlang/OTP platform.
This vulnerability is a Remote Code Execution (RCE) opportunity without authentication and affects several Erlang/OTP branches before patches:

• versions 27 before 27.3.3
• versions 26 before 26.2.5.11
• versions 25 before 25.3.2.20

Erlang/OTP is widely used as the foundation for scalable distributed systems and is part of the stack of many well-known projects (e.g., messengers, message brokers, high-load web services).
The presence of a critical RCE vulnerability in the core SSH library endangers infrastructure that uses Erlang/OTP as a server or component with open SSH access.

Report Objective

To examine the vulnerability step by step and demonstrate the full research cycle:

1. Collection and structuring of materials:
   Find and organize publicly available data about CVE-2025-32433, describe its essence and potential impact.

2. Definition of CPE and configuration conditions:
   Provide a list of CPEs and configuration conditions for which the vulnerability is relevant.

3. Development of PoC/Exploit:
   Create and demonstrate a working exploitation prototype in a test environment.

4. Safe mass verification methods:
   Describe three ways to check vulnerable hosts:

   • using nuclei in active mode (minimal harm during exploitation);
   • using nuclei in passive mode (by software versions or indirect signs);
   • using a custom Python 3 script (or Go) with multithreading support.

---

⚠️ Disclaimer

This research is conducted solely for educational and ethical purposes and has been performed only in a controlled test environment.
The author is not responsible for any misuse of the provided information.
Use this information only for learning and improving the security of your own systems.

---

Vulnerability Details

Erlang is a programming language designed for building highly parallel and fault-tolerant systems.
Its platform Open Telecom Platform (OTP) has been used for many years in critical infrastructures — from telecommunications to the financial sector.

Erlang/OTP in Industry

In OT (operational technology) environments and 5G networks, Erlang/OTP is valued for its scalability and ability to ensure continuous system operation with minimal downtime.
For remote administration, such networks often use the built-in SSH implementation in Erlang/OTP.
This is precisely what makes the CVE-2025-32433 vulnerability particularly dangerous for such environments.

The Problem

Secure interaction in Erlang/OTP is provided by its own SSH implementation, which:

• handles encrypted connections,
• file transfers,
• and — importantly — command execution.

A vulnerability in this implementation allows an attacker with network access to execute arbitrary code without authentication, creating a direct threat to vulnerable assets.

Scope of Distribution

According to global internet scanning data (Cortex Xpanse, April 2025), vulnerable Erlang/OTP SSH services are widely available on the internet and operate not only on standard ports but also, for example, on TCP port 2222.
This port is often used by outdated industrial automation components and the Ethernet/IP implicit messaging protocol, expanding the potential attack vector.

The vulnerability is associated with SSH versions included in Erlang/OTP releases.
The distribution of vulnerable services on ports characteristic of various industries creates a significant global attack surface.

Most Affected Industries

Telemetry showed that over 85% of exploitation attempts were recorded on firewalls in the OT segment of the following sectors:

• Healthcare
• Agriculture
• Media and entertainment
• High technology

At the same time, despite a high dependence on OT, in sectors:

• utilities,
• energy,
• mining,
• aerospace and defense

no factors were identified that would contribute to the active spread of this particular threat.

Industry-Specific Features

• In professional and legal services, detections were recorded mainly in IT networks.
• In manufacturing, wholesale and retail trade, and financial services, attacks were distributed roughly equally between IT and OT segments, requiring comprehensive protection.

Vulnerability Status

• Severity: CVSS 3.1 score 10.0 (critical) according to Offsec and Tenable criteria. Exploitation complexity is low, does not require credentials or user interaction.
• KEV list: Added to the CISA Known Exploited Vulnerabilities (KEV) catalog on June 9, 2025, highlighting the need for urgent remediation.

Affected Products and Configuration Conditions

CPE Identifiers

CVE-2025-32433 is registered in the NVD database with the following typical CPEs (Common Platform Enumeration):

• cpe:2.3:a:erlang:otp:25:*:*:*:*:*:*:*
• cpe:2.3:a:erlang:otp:26:*:*:*:*:*:*:*
• cpe:2.3:a:erlang:otp:27:*:*:*:*:*:*:*

Minor releases below the following patch versions are considered vulnerable:

• 25.x — up to 25.3.2.20 inclusive
• 26.x — up to 26.2.5.11 inclusive
• 27.x — up to 27.3.3 inclusive

Conditions Under Which the Vulnerability Manifests

• The host must be running the built-in Erlang/OTP SSH daemon (ssh:daemon/2), not an external openssh.
• The SSH port (standard 22 or custom, e.g., 2222) must be accessible for remote connections from the attacker's network.
• At the configuration level, no special flags are required — the vulnerability is related to protocol logic in the Erlang/OTP code, not to specific ssh:daemon/2 options.
• Authentication can be any type (password, key, etc.) — the bug is exploited before the authentication stage.

⚠️ If Erlang/OTP is used only as a client library without an SSH server, or if the server is isolated in a closed network, the vulnerability is not reachable.

---

Technical Overview

The vulnerability arises because the built-in SSH server in Erlang/OTP incorrectly handles the pre-authentication process.
Two types of connection protocol messages play a key role — SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST.
According to the standard RFC 4254, such messages should only be accepted after successful user authentication.
Any attempt to send them earlier should immediately result in connection termination.
In the case of CVE-2025-32433, the SSH daemon does not enforce this rule, allowing an attacker to open a session channel and send an exec request with an arbitrary command without providing valid credentials.
In other words, this leads to unauthenticated remote code execution (RCE) — the attacker can take control of the server without knowing the username, password, or key.

The SSH Connection protocol operates above the transport and authentication layers of SSH.
It provides interactive login, remote command execution, and port forwarding functions.
In the vulnerable SSH implementation in Erlang/OTP, these two messages — SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST, necessary for channel initiation and command requests — become the attack point:
an attacker can send specially crafted traffic that tricks the system into executing arbitrary code before authentication.

---

PoC / Exploit