CVE-2025-32433
CRITICAL CISA KEVDescription
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Is your site exposed to CVE-2025-32433?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
CISA Known Exploited Vulnerability
This vulnerability is actively exploited in the wild.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| erlang | erlang\/otp |
| erlang | erlang\/otp |
| erlang | erlang\/otp |
| cisco | confd_basic |
| cisco | confd_basic |
| cisco | confd_basic |
| cisco | confd_basic |
| cisco | confd_basic |
| cisco | network_services_orchestrator |
| cisco | network_services_orchestrator |
| cisco | network_services_orchestrator |
| cisco | network_services_orchestrator |
| cisco | network_services_orchestrator |
| cisco | network_services_orchestrator |
| cisco | cloud_native_broadband_network_gateway |
| cisco | inode_manager |
| cisco | smart_phy |
| cisco | ultra_packet_core |
| cisco | ultra_services_platform |
| cisco | staros |
| cisco | optical_site_manager |
| cisco | ncs_1001 |
| cisco | ncs_1002 |
| cisco | ncs_1004 |
| cisco | ncs_2000_shelf_virtualization_orchestrator_firmware |
| cisco | ncs_2000_shelf_virtualization_orchestrator_module |
| cisco | enterprise_nfv_infrastructure_software |
| cisco | ultra_cloud_core |
| cisco | rv160w_firmware |
| cisco | rv160w |
| cisco | rv260_firmware |
| cisco | rv260 |
| cisco | rv160_firmware |
| cisco | rv160 |
| cisco | rv260p_firmware |
| cisco | rv260p |
| cisco | rv260w_firmware |
| cisco | rv260w |
| cisco | rv340_firmware |
| cisco | rv340 |
| cisco | rv340w_firmware |
| cisco | rv340w |
| cisco | rv345_firmware |
| cisco | rv345 |
| cisco | rv345p_firmware |
| cisco | rv345p |
| debian | debian_linux |
References
Advisories & Patches
Other References
Frequently Asked Questions
What is CVE-2025-32433? +
How severe is CVE-2025-32433? +
What products are affected by CVE-2025-32433? +
How do I check if I'm vulnerable to CVE-2025-32433? +
Related Vulnerabilities
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to …
A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring …
Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT …
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR …
A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical …
A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not …