CVE-2025-32433 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function
Attackers can execute arbitrary code remotely without authentication by exploiting a flaw in the Erlang/OTP SSH server's protocol handling.
- Exploited in the wild
- Since 9 Jun 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32433?
CVE-2025-32433 is a critical authentication bypass vulnerability in Debian Debian Linux, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Weakness: CWE-306
Which versions are affected by CVE-2025-32433?
It affects 23 products.
Linux distribution packages (16)
erlang SUSE:Enterprise Storage 7.1 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Manager Proxy 4.3 | All versions | 23.3.4.19-150300.3.20.1 |
erlang SUSE:Manager Server 4.3 | All versions | 23.3.4.19-150300.3.20.1 |
erlang openSUSE:Leap 15.6 | All versions | 23.3.4.19-150300.3.20.1 |
Products include Cisco Cloud Native Broadband Network Gateway, Cisco Confd Basic, Cisco Enterprise Nfv Infrastructure Software, Cisco Inode Manager, Cisco Ncs 2000 Shelf Virtualization Orchestrator Firmware, Cisco Network Services Orchestrator and 17 more.
How do I fix CVE-2025-32433?
Upgrade to a fixed version. US federal agencies must fix it by 30 Jun 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-32433 being exploited?
Yes. Attackers have exploited CVE-2025-32433 in the wild since at least 9 Jun 2025.
Public exploit code: 1 Metasploit module and 41 proofs of concept on GitHub.
Sources
Also known as AZL-60441, AZL-60583, CLEANSTART-2026-RU46507, DEBIAN-CVE-2025-32433, GHSA-37cp-fgq5-7wc2, OESA-2025-1461 and 5 more.