Exploited vulnerabilitiesBriefPublic record
Erlang/OTP SSH pre-auth RCE (CVE-2025-32433)
Disclosed 16 Apr 2025. CVSS 10. Unauthenticated SSH connection-protocol messages lead to RCE.
- Disclosed
What happened
- Fixed: OTP-27.3.3, 26.2.5.11, 25.3.2.20. Affects anything built on OTP’s ssh application, including Elixir apps and Cisco and Ericsson gear.
- KEV: 9 Jun 2025. Unit 42 saw OT-network exploitation.
Live scores
Live scores
CVE-2025-32433- EPSS
- 0.989
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2025-06-09
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
- https://nvd.nist.gov/vuln/detail/CVE-2025-32433
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.