CVE-2025-32433

The vulnerability in the Erlang/OTP libraries, specifically within the SSH server implementation, presents a critical risk due to its potential for unauthenticated remote code execution (RCE). This flaw arises from improper handling of SSH protocol messages, allowing an attacker to bypass authentication mechanisms entirely. By exploiting this weakness, an adversary can execute arbitrary commands on the affected system without requiring valid credentials. The severity of this vulnerability is underscored by its perfect score on the Common Vulnerability Scoring System (CVSS), indicating that it poses an extreme threat to the confidentiality, integrity, and availability of the systems involved.

Attack vectors associated with this vulnerability are particularly concerning due to the ease with which they can be executed. An attacker could leverage this flaw remotely, requiring no physical access to the target system. The exploitation process may involve sending specially crafted SSH messages that the server mishandles, leading to the execution of unauthorized commands. Given the widespread use of Erlang/OTP in various applications, including telecommunications and distributed systems, the potential for exploitation is vast. Additionally, the presence of affected Cisco products further amplifies the risk, as these devices are often integral to enterprise networks and critical infrastructure.

The real-world impact of this vulnerability is substantial, with significant implications for business operations and data security. Organizations utilizing affected versions of Erlang/OTP or Cisco products may find themselves vulnerable to data breaches, system compromise, and service disruptions. The ability for an attacker to execute arbitrary code remotely means that they could manipulate or exfiltrate sensitive data, deploy malware, or even take control of critical systems. The financial repercussions of such incidents can be severe, including regulatory fines, loss of customer trust, and the costs associated with incident response and recovery efforts.

To effectively address this vulnerability, organizations must implement robust detection and mitigation strategies. Immediate steps should include upgrading to the patched versions of Erlang/OTP, which rectify the flaw in the SSH server. In scenarios where immediate upgrades are not feasible, temporary workarounds such as disabling the SSH server or restricting access through firewall rules should be employed to minimize exposure. Continuous monitoring for unusual activity on affected systems is also essential, as it can help detect potential exploitation attempts. Organizations should consider employing intrusion detection systems (IDS) and conducting regular security assessments to identify and remediate vulnerabilities proactively.

In conclusion, the vulnerability within the SSH server of Erlang/OTP represents a critical security threat that can lead to severe consequences for affected organizations. Given the ease of exploitation and the potential for significant business impact, it is imperative for organizations to prioritize the implementation of security patches and to adopt comprehensive security practices. By doing so, they can safeguard their systems against unauthorized access and ensure the integrity of their operations in an increasingly complex threat landscape.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-32433, coinciding with the emergence of new proof-of-concept exploit tools circulating on public repositories. This development indicates that threat actors are increasingly equipped to leverage the unauthenticated remote code execution vulnerability in Erlang/OTP SSH servers. Although the EPSS score has slightly decreased, our telemetry reveals a sharp upward trend in detection activity, suggesting growing adversary interest and operationalization of this flaw. The availability of multiple publicly accessible exploit implementations lowers the barrier for exploitation, broadening the potential attacker base beyond highly skilled actors. Consequently, the threat level associated with this vulnerability has intensified, elevating it from a theoretical risk to a more imminent and actionable threat for defenders monitoring Erlang/OTP deployments. This shift underscores the urgency for heightened vigilance in network monitoring and incident response readiness.

Update 2 — June 13, 2026

CSURFACE threat intelligence has identified a notable increase in the Exploit Prediction Scoring System (EPSS) score for CVE-2025-32433, rising by approximately 17%, signaling an elevated likelihood of exploitation in the near term. This upward trend coincides with a marked reduction in detection activity across our sensors, which may indicate adversaries are refining their tactics to evade existing monitoring mechanisms. Concurrently, the exploit landscape has expanded with the emergence of several new proof-of-concept tools publicly available on GitHub, lowering the technical barrier for threat actors to leverage this critical pre-authentication remote code execution vulnerability. While ransomware usage remains unconfirmed, the combination of increased exploitability and stealthier attack patterns heightens the risk profile for organizations running Erlang/OTP SSH servers. This evolving environment necessitates that defenders recognize the shift from theoretical risk to a more imminent and actionable threat, as adversaries appear to be operationalizing the vulnerability with greater sophistication and persistence.

Update 3 — July 05, 2026

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2025-32433, accompanied by a growing number of publicly available proof-of-concept exploits on GitHub. This uptick in activity, while not yet rapid, signals a gradual operationalization of the vulnerability by threat actors. The expanded availability of technical resources lowers the barrier for less sophisticated adversaries to attempt remote code execution against vulnerable Erlang/OTP SSH servers. Although ransomware involvement remains unconfirmed, the persistence and diversification of exploit techniques suggest an evolving threat landscape that could facilitate broader attack campaigns. Consequently, the risk level for organizations running affected Erlang/OTP versions has shifted from theoretical to more imminent, warranting heightened vigilance as adversaries increasingly integrate this critical flaw into their toolsets.