Erlang/OTP SSH RCE (CVE-2025-32433)

title: Erlang/OTP SSH Server Seen In Zeek SSH Logs
id: 29390c3f-3281-5bde-aa00-695457813a35
status: experimental
description: Finds SSH servers that announce Erlang/OTP in their software banner. Unit 42 notes CVE-2025-32433 exposure is inferred from SSH versions tied to Erlang/OTP releases, and ET Open keys its banner rule on the same "Erlang/" string. Use it to build an inventory, then check versions.
references:
    - https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/
    - https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules
author: vuln2shell
date: 2026-10-23
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-32433
logsource:
    product: zeek
    service: ssh
detection:
    selection:
        server|contains: 'Erlang/'
    condition: selection
falsepositives:
    - Patched Erlang/OTP SSH servers also match; compare the version against the fixed releases
level: low

(sourcetype="bro:ssh:json" OR sourcetype="zeek:ssh") server="*Erlang/*"
| eval dest=coalesce(dest, 'id.resp_h'), dest_port=coalesce(dest_port, 'id.resp_p')
| stats count min(_time) as firstTime max(_time) as lastTime values(server) as server_banner by dest dest_port

DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2025-32433"
| project DeviceName, OSPlatform, SoftwareVendor, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel

alert ssh $HOME_NET any -> any any (msg:"ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)"; flow:established,to_client; flowbits:set,ET.ErlangOTPBanner; ssh.software; content:"Erlang/"; pcre:"/^(?:(?:4\x2e(?:[0-9]|1[0-5])\x2e[0-3]\x2e(?:[0-9]|1[0-1]))|(?:5\x2e2\x2e(?:[0-9]))|(?:5\x2e1\x2e[0-4]\x2e[0-7]))/R"; reference:url,www.runzero.com/blog/erlang-otp-ssh/; reference:cve,2025-32433; classtype:misc-activity; sid:2061790; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, tag Exploit, updated_at 2025_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:src_ip;)

alert ssh any any -> $HOME_NET any (msg:"ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)"; flow:established,to_server; flowbits:isset,ET.ErlangOTPBanner; content:"exec"; fast_pattern; byte_jump:0,0,relative,post_offset -13; content:"|62|"; within:1; reference:cve,2025-32433; reference:url,github.com/darses/CVE-2025-32433/blob/main/README.md; classtype:attempted-admin; sid:2061797; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

rule VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25 {
   meta:
      description = "Detects binaries vulnerable to CVE-2025-32433 in Erlang/OTP SSH"
      author = "Pierre-Henri Pezier, Florian Roth"
      reference = "https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10"
      date = "2025-04-18"
      score = 60
      id = "fd0ff924-d0f3-5dcc-90f3-55875b90102e"
   strings:
      $a1 = { 46 4F 52 31 ?? ?? ?? ?? 42 45 41 4D }

      $s1 = "ssh_connection.erl"

      $fix1 = "chars_limit"
      $fix2 = "allow    macro_log"
      $fix3 = "logger"
      $fix4 = "max_log_item_len"
   condition:
      filesize < 1MB
      and $a1 at 0 // BEAM file header
      and $s1
      and not 1 of ($fix*)
}