Quantum Secular Labs / Blog / Advisories

CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

CVE-2025-32433 is rated critical with a CVSS v3.1 base score of 10.0 and affects Erlang Erlang/OTP, along with 22 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-09, which means exploitation in the wild has been observed.

Vulnerability description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Severity breakdown

CVSS v3.1 10.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-306: Missing Authentication for Critical Functionality

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected products

  • Erlang/Otp: before 25.3.2.20; from 26.0 before 26.2.5.11; from 27.0 before 27.3.3
  • Cisco Confd Basic: before 7.7.19.1; from 8.0.18 before 8.1.16.2; from 8.2 before 8.2.11.1; from 8.3 before 8.3.8.1; from 8.4 before 8.4.4.1
  • Cisco Network Services Orchestrator: before 5.7.19.1; from 5.8 before 6.1.16.2; from 6.2 before 6.2.11.1; from 6.3 before 6.3.8.1; from 6.4 before 6.4.1.1; from 6.4.2 before 6.4.4.1
  • Cisco Cloud Native Broadband Network Gateway: before 2025.03.1
  • Cisco Inode Manager: all versions listed by NVD
  • Cisco Smart Phy: before 25.2
  • Cisco Ultra Packet Core: before 2025.03
  • Cisco Ultra Services Platform: all versions listed by NVD
  • Cisco Staros: before 2025.03
  • Cisco Optical Site Manager: before 25.2.1
  • Cisco Ncs 2000 Shelf Virtualization Orchestrator Firmware: before 25.1.1
  • Cisco Enterprise Nfv Infrastructure Software: before 4.18
  • Cisco Ultra Cloud Core: before 2025.03.1
  • Cisco Rv160w Firmware: all versions listed by NVD
  • Cisco Rv260 Firmware: all versions listed by NVD

References