Skip to content
Fencer Vulns
critical 10.0

CVE-2025-32433 kev in the critical feed json

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

published 2025-04-16 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-11793

cvss
10.0
version 3.1, CNA
cisa kev
Exploited
added 2025-06-09
epss
98.9%
EPSS 98.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit

Summary

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • erlang erlang/otp 25.3.2.20, 26.2.5.11, 27.3.3
  • erlang Debian 12 1:25.2.3+dfsg-1+deb12u1
  • erlang Debian 14, Debian 13 1:27.3.3+dfsg-1

debian advisories DEBIAN-CVE-2025-32433

  • erlang Ubuntu 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5
  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.4
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.3
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm1
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm1

ubuntu advisories UBUNTU-CVE-2025-32433

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 23.3.4.19-150300.3.20.1
  • erlang26 SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 26.2.1-150300.7.11.1

suse advisories SUSE-SU-2025:1357-1SUSE-SU-2025:1356-1

  • erlang Alpine 3.21 26.2.5.11-r0

alpine advisories ALPINE-CVE-2025-32433

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang Azure Linux 3.0 26.2.5.11-1
  • erlang CBL-Mariner 2.0 25.3.2.20-1

azure linux advisories AZL-60441AZL-60583

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-043-06 updated cvss 10.0

Siemens SINEC OS

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.3
    affected: fixed in V3.3 support.industry.siemens.com
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.3
    affected: fixed in V3.3
  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) < 3.3 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) < 3.3 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) < 3.3 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) < 3.3 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) < 3.3 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) < 3.3
    +8 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) < 3.3 Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) < 3.3 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) < 3.3 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) < 3.3 Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) < 3.3
    affected: fixed in V3.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-140-07 updated cvss 10.0

Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)

  • Schneider Electric Galaxy VL <=18.5.0 Schneider Electric Galaxy VS <=6.118.0 Schneider Electric Galaxy VXL <=15.21.0
    affected: vendor fix, mitigation se.com
  • Schneider Electric Galaxy VL 18.10.0 Schneider Electric Galaxy VS 6.123.0 Schneider Electric Galaxy VXL 15.29.0
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/ssh/ssh_erlangotp_rce)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
17 mo ago
Patch by
2025-06-30 (16 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Erlang, Erlang/OTP
CISA name
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • TheGentlemen ransomware gang

reported by research.checkpoint.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1021.004 SSH exploitation
  • T1059 Command and Scripting Interpreter primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
14 mo ago

Exploit prediction

98.92% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • erlang otp

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.