CVE-2025-32433
Description
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
CISA KEV
- Vendor
- Erlang
- Product
- Erlang/OTP
- Due date
- 2025-06-30
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cisa-kev — This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy ; https://nvd.nist.gov/vuln/detail/CVE-2025-32433
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-32433.html
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-32433
Exploits
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1:25.2.3+dfsg-1+deb12u1 |
| debian | bullseye | fixed | 1:23.2.6+dfsg-1+deb11u2 |
| debian | forky | fixed | 1:27.3.3+dfsg-1 |
| debian | sid | fixed | 1:27.3.3+dfsg-1 |
| debian | trixie | fixed | 1:27.3.3+dfsg-1 |
| sles | affected | |
References
- https://security-tracker.debian.org/tracker/CVE-2025-32433
- https://www.suse.com/security/cve/CVE-2025-32433.html
- This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy ; https://nvd.nist.gov/vuln/detail/CVE-2025-32433
Verify integrity in audit chain (admin only). AS-IS.