CVE-2025-32433

Introduction

This document presents a study of the vulnerability CVE-2025-32433, affecting the built-in SSH server implementation in the Erlang/OTP platform.
This vulnerability is a Remote Code Execution (RCE) opportunity without authentication and affects several Erlang/OTP branches before patches:

• versions 27 before 27.3.3
• versions 26 before 26.2.5.11
• versions 25 before 25.3.2.20

Erlang/OTP is widely used as the foundation for scalable distributed systems and is part of the stack of many well-known projects (e.g., messengers, message brokers, high-load web services).
The presence of a critical RCE vulnerability in the core SSH library endangers infrastructure that uses Erlang/OTP as a server or component with open SSH access.

Report Objective

To examine the vulnerability step by step and demonstrate the full research cycle:

1. Collection and structuring of materials:
   Find and organize publicly available data about CVE-2025-32433, describe its essence and potential impact.

2. Definition of CPE and configuration conditions:
   Provide a list of CPEs and configuration conditions for which the vulnerability is relevant.

3. Development of PoC/Exploit:
   Create and demonstrate a working exploitation prototype in a test environment.

4. Safe mass verification methods:
   Describe three ways to check vulnerable hosts:

   • using nuclei in active mode (minimal harm during exploitation);
   • using nuclei in passive mode (by software versions or indirect signs);
   • using a custom Python 3 script (or Go) with multithreading support.

⚠️ Disclaimer

This research is conducted solely for educational and ethical purposes and has been performed only in a controlled test environment.
The author is not responsible for any misuse of the provided information.
Use this information only for learning and improving the security of your own systems.

Vulnerability Details

Erlang is a programming language designed for building highly parallel and fault-tolerant systems.
Its platform Open Telecom Platform (OTP) has been used for many years in critical infrastructures — from telecommunications to the financial sector.

Erlang/OTP in Industry

In OT (operational technology) environments and 5G networks, Erlang/OTP is valued for its scalability and ability to ensure continuous system operation with minimal downtime.
For remote administration, such networks often use the built-in SSH implementation in Erlang/OTP.
This is precisely what makes the CVE-2025-32433 vulnerability particularly dangerous for such environments.

The Problem

Secure interaction in Erlang/OTP is provided by its own SSH implementation, which:

• handles encrypted connections,
• file transfers,
• and — importantly — command execution.

A vulnerability in this implementation allows an attacker with network access to execute arbitrary code without authentication, creating a direct threat to vulnerable assets.

Scope of Distribution

According to global internet scanning data (Cortex Xpanse, April 2025), vulnerable Erlang/OTP SSH services are widely available on the internet and operate not only on standard ports but also, for example, on TCP port 2222.
This port is often used by outdated industrial automation components and the Ethernet/IP implicit messaging protocol, expanding the potential attack vector.

The vulnerability is associated with SSH versions included in Erlang/OTP releases.
The distribution of vulnerable services on ports characteristic of various industries creates a significant global attack surface.

Most Affected Industries

Telemetry showed that over 85% of exploitation attempts were recorded on firewalls in the OT segment of the following sectors:

• Healthcare
• Agriculture
• Media and entertainment
• High technology

At the same time, despite a high dependence on OT, in sectors:

• utilities,
• energy,
• mining,
• aerospace and defense

no factors were identified that would contribute to the active spread of this particular threat.

Industry-Specific Features

• In professional and legal services, detections were recorded mainly in IT networks.
• In manufacturing, wholesale and retail trade, and financial services, attacks were distributed roughly equally between IT and OT segments, requiring comprehensive protection.

Vulnerability Status

• Severity: CVSS 3.1 score 10.0 (critical) according to Offsec and Tenable criteria. Exploitation complexity is low, does not require credentials or user interaction.
• KEV list: Added to the CISA Known Exploited Vulnerabilities (KEV) catalog on June 9, 2025, highlighting the need for urgent remediation.

Affected Products and Configuration Conditions

CPE Identifiers

CVE-2025-32433 is registered in the NVD database with the following typical CPEs (Common Platform Enumeration):

• cpe:2.3:a:erlang:otp:25:*:*:*:*:*:*:*
• cpe:2.3:a:erlang:otp:26:*:*:*:*:*:*:*
• cpe:2.3:a:erlang:otp:27:*:*:*:*:*:*:*

Minor releases below the following patch versions are considered vulnerable:

• 25.x — up to 25.3.2.20 inclusive
• 26.x — up to 26.2.5.11 inclusive
• 27.x — up to 27.3.3 inclusive

Conditions Under Which the Vulnerability Manifests

• The host must be running the built-in Erlang/OTP SSH daemon (ssh:daemon/2), not an external openssh.
• The SSH port (standard 22 or custom, e.g., 2222) must be accessible for remote connections from the attacker's network.
• At the configuration level, no special flags are required — the vulnerability is related to protocol logic in the Erlang/OTP code, not to specific ssh:daemon/2 options.
• Authentication can be any type (password, key, etc.) — the bug is exploited before the authentication stage.

⚠️ If Erlang/OTP is used only as a client library without an SSH server, or if the server is isolated in a closed network, the vulnerability is not reachable.

Technical Overview

The vulnerability arises because the built-in SSH server in Erlang/OTP incorrectly handles the pre-authentication process.
Two types of connection protocol messages play a key role — SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST.
According to the standard RFC 4254, such messages should only be accepted after successful user authentication.
Any attempt to send them earlier should immediately result in connection termination.
In the case of CVE-2025-32433, the SSH daemon does not enforce this rule, allowing an attacker to open a session channel and send an exec request with an arbitrary command without providing valid credentials.
In other words, this leads to unauthenticated remote code execution (RCE) — the attacker can take control of the server without knowing the username, password, or key.

The SSH Connection protocol operates above the transport and authentication layers of SSH.
It provides interactive login, remote command execution, and port forwarding functions.
In the vulnerable SSH implementation in Erlang/OTP, these two messages — SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST, necessary for channel initiation and command requests — become the attack point:
an attacker can send specially crafted traffic that tricks the system into executing arbitrary code before authentication.

PoC / Exploit

As part of the research, a working Proof-of-Concept for CVE-2025-32433 has been prepared.

Files

• CVE-2025-32433.py — Python script that manually constructs SSH packets (SSH_MSG_KEXINIT, SSH_MSG_CHANNEL_OPEN, SSH_MSG_CHANNEL_REQUEST) and sends them before authentication.
  In vulnerable versions of Erlang/OTP, this allows executing an arbitrary command on the server side — in the PoC it creates a file /lab.txt with the text cyberok.

• ssh_server.erl — minimal Erlang module that starts the built-in OTP SSH daemon on port 2222. It is only needed for demonstration and runs inside a Docker container.

• Dockerfile — container build recipe that automatically compiles the specified Erlang/OTP version and starts the test SSH server.

⚠️ This PoC is intended exclusively for local testing and educational purposes. Do not use in production or publicly accessible networks.

Local Testing in Docker

1. Build the image: git clone https://github.com/iteride/CVE-2025-32433.git && cd CVE-2025-32433/POC/ && docker build -t cve-ssh .

2. Run the image

   root@kitploit:~

   docker run -d --name cve-ssh -p 2222:2222 cve-ssh
   

3. Demonstrate POC

nuclei-template for quick verification

Passive check

The passive template looks for indirect signs of vulnerability without performing actual attack actions.
It only analyzes the "surface" information that the service itself provides:

• Erlang/OTP version banner,
• response headers,
• other open metadata.

If a vulnerable version is detected (e.g., OTP 25.3.2.19 or 26.2.5.10), nuclei marks the host as potentially vulnerable.
⚠️ This approach is safe: no malicious packets or exploitation attempts are made.

nuclei -u 127.0.0.1:2222 -t erlang-passive.yaml

Active check

The active template performs a controlled imitation of an attack:
it sends specially crafted SSH packets before authentication and checks whether the vulnerability triggers.
To record the fact of exploitation, Interactsh is used — if the remote server executed the malicious request, a DNS callback will appear on the Interactsh panel.

✅ This test confirms the real possibility of remote code execution (RCE),
but is performed only in an isolated test environment.

nuclei -u 127.0.0.1:2222 -t erlang-active.yaml -code

Multithreaded script ⚡️

Differences from nuclei-template:

1. The script works similarly to the active nuclei template, but is much faster.
2. The script determines whether the server is vulnerable much more accurately, unlike nuclei, which has problems with interactsh analysis.

Running the script

⚠️ Before running, make sure that interactsh-client is installed and running.

python3  babyfon.py -f targets.txt -d your.interactsh_domain

After running, check DNS interactions in interactsh-client. (In the example, two targets are scanned: one is vulnerable, the other is already patched)

Comparison of speed and accuracy with nuclei ℹ️

1. Nuclei:

2. babyfon

Test conclusion:

• babyfon scan completed in 0.95 seconds and correctly identified that one of the hosts was already updated and not vulnerable.
• nuclei scan completed in 9.9 seconds and incorrectly showed that both hosts were vulnerable.