liam-worsley/cve-2025-32433-poc-analysisThis is an analysis for CVE-2025-32433 (Erlang OTP SSH Vulnerability). I did not write any of the code, I only wrote comments describing what the code does and instructions for setting up the server to perform the exploit yourself.
FAQ - CVE-2025-32433
What is Erlang OTP? Erlang is a general-purpose programming language. OTP (Open Telecom Platform) is a collection of middleware, libraries, and design principles used for fault tolerance using the BEAM VPN.
Why is this version of Erlang vulnerable? OTP 26.2.5.10 is vulnerable because the SSH server does not properly reject certain SSH connection-protocol messages before the client has authenticated. Typical flow:
Client connects to the SSH server.
Client and server negotiate SSH algorithms and perform the cryptographic key exchange.
An encrypted SSH connection is established. --ACTUAL EXPLOIT STARTS HERE
The client begins user authentication, such as password or public-key authentication.
If authentication succeeds, the client may open SSH channels and request operations through them.
Why this is flawed: In the vulnerable version, the server can process certain connection-protocol packets, including SSH_MSG_CHANNEL_OPEN, before user authentication has successfully completed. An attacker can therefore establish the SSH transport connection but skip successful user authentication, then send messages that should only be accepted from an authenticated user. This can ultimately allow unauthenticated remote code execution.
How can I replicate this myself? Download and extract this Open it in VS Code Install and sign into Docker Desktop Run the command in this directory: docker build -t local-erlang-ssh . Run the command: docker run --rm -it -p 127.0.0.1:2222:2222 local-erlang-ssh Open a new powershell and test to make sure it started: Test-NetConnection 127.0.0.1 -Port 2222 Wait a minute and it should say TcpTestSucceeded: true Go to the python file and click run It should now show in the terminal the EXPLOIT Use the command "docker ps" to get the container ID. Then paste this command docker exec CONTAINER_ID cat /lab.txt It should return the word "pwned" showing that the exploit worked. To stop the container, go back to the original terminal where you started the docker container and do Control+C (may have to do it twice)
How could I protect my devices from this vulnerability? If you have a Erlang OTP SSH server, update it to 26.2.5.11 or later.
Where can I go to learn more? Remove the "[" and "]" from around the punctuation, I hate having hot links. Original code by Matt Keely: https[:]//github[.]com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py Matt Keely's walkthrough of how he made the code: https[:]//platformsecurity[.]com/blog/CVE-2025-32433-poc NIST website: https[:]//nvd.nist[.]gov/vuln/detail/CVE-2025-32433 Erlang: https[:]//www.youtube[.]com/watch?v=M7uo5jmFDUw
