{"slug":"erlang-otp-ssh","title":"Erlang/OTP SSH RCE (CVE-2025-32433)","shortName":"Erlang/OTP SSH","summary":"Unauthenticated remote code execution in the Erlang/OTP SSH server via pre-authentication protocol message handling. CVSS 10.0. Exploit attempts observed from May 2025, including against OT networks. Listed in CISA KEV on 9 Jun 2025.","isExample":false,"draft":false,"family":"erlang-otp-ssh","kind":"shared-component","aliases":["CVE-2025-32433","GHSA-37cp-fgq5-7wc2"],"publishedAt":"2025-04-16","updatedAt":"2026-10-24","patchStatus":"partly-patched","exploited":true,"scores":{"cve":"CVE-2025-32433","cvss":{"cve":"CVE-2025-32433","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-32433","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2025-32433","score":0.98786,"percentile":0.99927,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32433","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2025-32433","listed":true,"dateAdded":"2025-06-09","dueDate":"2025-06-30","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote code execution in the Erlang/OTP SSH server (CVE-2025-32433), scored CVSS 10.0 by the CNA. Listed in CISA KEV. Attempts were seen from May 2025, including against OT networks.","action":"Upgrade embedded Erlang/OTP to a fixed OTP line, or disable and firewall the SSH server until every appliance that ships it is rebuilt."},"seenInTheWild":[{"metric":"exposed","value":253,"observer":"Censys","date":"2025-04-18","method":"Exposed Erlang SSH servers by banner; not necessarily vulnerable","sourceUrl":"https://censys.com/advisory/cve-2025-32433/"},{"metric":"exposed","value":275,"observer":"Palo Alto Networks Unit 42 (Cortex Xpanse)","date":"2025-05-09","method":"Distinct hosts with Erlang/OTP SSH services seen 16 Apr to 9 May 2025 (326 services)","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/"},{"metric":"exposed","value":294,"observer":"Shodan","date":"2026-10-23","method":"Product query \"SSH-2.0-Erlang\"","sourceUrl":"https://www.shodan.io/search?query=%22SSH-2.0-Erlang%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2025-06-09","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Shadowserver report","url":"https://www.shadowserver.org/what-we-do/network-reporting/accessible-ssh-report/","observer":"Shadowserver","metric":"exposed"},{"title":"Erlang OTP SSH Server Authentication Bypass RCE CVE-2025-32433 Attempt","url":"https://viz.greynoise.io/tags/erlang-otp-ssh-server-authentication-bypass-rce-cve-2025-32433-attempt","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2025-32433 is an unauthenticated remote code execution vulnerability in the Erlang/OTP SSH server. Fabian Baeumer, Marcel Maehren, Marcus Brinkmann, and Joerg Schwenk of Ruhr University Bochum reported it. The Erlang/OTP project published GHSA-37cp-fgq5-7wc2 on 16 Apr 2025 and rates it Critical 10.0.\n\nBy exploiting a flaw in SSH protocol message handling, a malicious actor can execute arbitrary commands without valid credentials. The advisory states all users running the Erlang/OTP SSH server are impacted. Patched OTP versions are 27.3.3, 26.2.5.11, and 25.3.2.20. Affected component versions include OTP >= 17.0 and ssh >= 3.0.1; versions prior to OTP 17.0 are also likely affected.\n\nUnit 42 observed a significant increase in exploitation activity from 1-9 May 2025, with 70% of detections from firewalls protecting OT networks. Cisco published a multi-product advisory covering ConfD, NSO, StarOS, Ultra Cloud Core components, and others.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"ssh","label":"Reach SSH port","detail":"Network access to a host running the Erlang/OTP SSH server (often not only TCP/22)."},{"id":"preauth","label":"Pre-auth messages","detail":"Attacker sends SSH connection protocol messages that should only be processed after authentication."},{"id":"bypass","label":"Missing auth check","detail":"Flawed message handling allows critical functions without successful authentication (CWE-306)."},{"id":"exec","label":"Code exec","detail":"Arbitrary commands run on the host. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2025-06-09","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2025-32433, Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability. dateAdded 2025-06-09."},"firstSeen":{"date":"2025-05-01","source":"Unit 42","note":"Unit 42 sensors detected exploit attempts with the earliest observation on 1 May 2025, and a significant increase from 1-9 May 2025."},"vendorStatements":[{"vendor":"Erlang/OTP","date":"2025-04-16","statement":"A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE).","url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","retracted":false},{"vendor":"Unit 42","date":"2025-08-11","statement":"Our telemetry confirms active exploitation attempts of CVE-2025-32433... earliest observation occurring on May 1, 2025. 70% of our detections originating from firewalls protecting global operational technology (OT) networks.","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","retracted":false}]},"timeline":[{"date":"2025-04-16","event":"Erlang/OTP publishes GHSA-37cp-fgq5-7wc2 and patched OTP 27.3.3 / 26.2.5.11 / 25.3.2.20.","source":{"title":"Unauthenticated Remote Code Execution in Erlang/OTP SSH","url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","publisher":"Erlang/OTP"},"kind":"patch","key":true},{"date":"2025-04-18","event":"Public PoC repository ProDefense/CVE-2025-32433 appears on GitHub.","source":{"title":"ProDefense/CVE-2025-32433","url":"https://github.com/ProDefense/CVE-2025-32433","publisher":"ProDefense"},"kind":"poc","key":true},{"date":"2025-04-22","event":"Cisco publishes a multi-product advisory for Erlang/OTP SSH in Cisco products.","source":{"title":"Multiple Cisco Products Unauthenticated RCE in Erlang/OTP SSH Server","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","publisher":"Cisco"},"kind":"vendor","key":true},{"date":"2025-05-01","event":"Unit 42 records earliest exploit attempts; activity spikes through 9 May 2025.","source":{"title":"Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","publisher":"Unit 42"},"kind":"exploited","key":true},{"date":"2025-06-09","event":"CISA adds CVE-2025-32433 to KEV.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true},{"date":"2025-08-11","event":"Unit 42 publishes OT-focused exploitation analysis.","source":{"title":"Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","publisher":"Unit 42"},"kind":"advisory","key":true}],"defenderActions":[{"title":"Upgrade Erlang/OTP","detail":"Move to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 (or later). Rebuild and redeploy any appliance or product that embeds the Erlang/OTP SSH library.","priority":"now","links":[{"label":"Erlang/OTP advisory","href":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2"}]},{"title":"Disable or firewall the Erlang SSH server until patched","detail":"The advisory's temporary workaround is to disable the SSH server or prevent access with firewall rules.","priority":"now"},{"title":"Inventory unusual SSH ports","detail":"Unit 42 notes vulnerable Erlang/OTP SSH services on ports beyond 22, including 2222 used by some industrial components. Inventory process and banner data, not only TCP/22.","priority":"soon","links":[{"label":"Unit 42 analysis","href":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/"}]},{"title":"Track vendor product advisories","detail":"Cisco and other vendors shipped product-specific timelines. Check each embedded product rather than assuming the host OS OpenSSH patch covers Erlang SSH.","priority":"soon","links":[{"label":"Cisco advisory","href":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy"}]}],"detection":[{"title":"Pre-authentication SSH channel requests","detail":"Unit 42 describes exploit traffic sending SSH connection protocol messages (codes >= 80) to open SSH ports before authentication succeeds.","logSource":"Network IDS / SSH protocol telemetry","kind":"generic","group":"web-proxy"},{"title":"Unexpected Erlang SSH listeners","detail":"Hunt for sshd-like services whose banners or binaries indicate Erlang/OTP SSH, including on non-standard ports such as 2222.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Check Point IPS: CPAI-2025-0221","detail":"Protection 'Erlang/OTP Remote Code Execution (CVE-2025-32433)', published 2025-04-28.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0221.html","date":"2025-04-28"},{"title":"Cisco Talos Snort: 1:64788","detail":"SERVER-OTHER Erlang/OTP SSH potential remote code execution attempt, enabled by default, released 2025-04-18. Rule doc references CVE-2025-32433.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2025-04-18","date":"2025-04-18"},{"title":"Fortinet FortiGuard IPS: 57832","detail":"IPS signature Erlang.OTP.SSH.Server.Remote.Code.Execution (57832), 2025-04-22.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2025-32433&engine=1","date":"2025-04-22"},{"title":"Juniper IDP: SSH:OPENSSH:ERLANG-OTP-SSH-BYP","detail":"IDP signature for CVE-2025-32433, release date 2025-08-11, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.SSH:OPENSSH:ERLANG-OTP-SSH-BYP.html","date":"2025-08-11"},{"title":"Palo Alto Networks Threat Prevention: 96163","detail":"Threat ID 96163 for CVE-2025-32433 per Unit 42.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11"},{"title":"Sophos Firewall IPS: Erlang/OTP SSH CVE-2025-32433 signatures","detail":"IPS release 18.23.27 (2025-04-22) lists 'Erlang/OTP SSH potential remote code execution attempt' and 'SSH Erlang/OTP CVE-2025-32433 Remote Code Execution Vulnerability'. No SIDs in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.23.27.html","date":"2025-04-22"}],"detectionRules":[{"id":"et-erlang-otp-vulnerable-banner","title":"ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)","language":"suricata","query":"alert ssh $HOME_NET any -> any any (msg:\"ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)\"; flow:established,to_client; flowbits:set,ET.ErlangOTPBanner; ssh.software; content:\"Erlang/\"; pcre:\"/^(?:(?:4\\x2e(?:[0-9]|1[0-5])\\x2e[0-3]\\x2e(?:[0-9]|1[0-1]))|(?:5\\x2e2\\x2e(?:[0-9]))|(?:5\\x2e1\\x2e[0-4]\\x2e[0-7]))/R\"; reference:url,www.runzero.com/blog/erlang-otp-ssh/; reference:cve,2025-32433; classtype:misc-activity; sid:2061790; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, tag Exploit, updated_at 2025_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:src_ip;)","logSource":"Suricata SSH inspection","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules","sourceDate":"2025-06-26","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Sets the ET.ErlangOTPBanner flowbit that the channel-request rule needs.","tested":"untested"},{"id":"et-erlang-otp-preauth-channel-request","title":"ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)","language":"suricata","query":"alert ssh any any -> $HOME_NET any (msg:\"ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)\"; flow:established,to_server; flowbits:isset,ET.ErlangOTPBanner; content:\"exec\"; fast_pattern; byte_jump:0,0,relative,post_offset -13; content:\"|62|\"; within:1; reference:cve,2025-32433; reference:url,github.com/darses/CVE-2025-32433/blob/main/README.md; classtype:attempted-admin; sid:2061797; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata SSH inspection","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2025-06-26","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Depends on the banner rule's flowbit; deploy both.","tested":"untested"},{"id":"yara-erlang-otp-vulnerable-beam","title":"VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25","language":"yara","query":"rule VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25 {\n   meta:\n      description = \"Detects binaries vulnerable to CVE-2025-32433 in Erlang/OTP SSH\"\n      author = \"Pierre-Henri Pezier, Florian Roth\"\n      reference = \"https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10\"\n      date = \"2025-04-18\"\n      score = 60\n      id = \"fd0ff924-d0f3-5dcc-90f3-55875b90102e\"\n   strings:\n      $a1 = { 46 4F 52 31 ?? ?? ?? ?? 42 45 41 4D }\n\n      $s1 = \"ssh_connection.erl\"\n\n      $fix1 = \"chars_limit\"\n      $fix2 = \"allow    macro_log\"\n      $fix3 = \"logger\"\n      $fix4 = \"max_log_item_len\"\n   condition:\n      filesize < 1MB\n      and $a1 at 0 // BEAM file header\n      and $s1\n      and not 1 of ($fix*)\n}","logSource":"Erlang BEAM files on disk (YARA scan)","author":"Pierre-Henri Pezier, Florian Roth","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_erlang_otp_ssh_cve_2025_32433.yar","sourceDate":"2025-04-18","license":"DRL-1.1","origin":"community","notes":"Finds unpatched ssh_connection BEAM files. Exposure, not compromise.","tested":"untested"},{"id":"v2s-sigma-zeek-erlang-ssh-server","title":"Erlang/OTP SSH Server Seen In Zeek SSH Logs","language":"sigma","query":"title: Erlang/OTP SSH Server Seen In Zeek SSH Logs\nid: 29390c3f-3281-5bde-aa00-695457813a35\nstatus: experimental\ndescription: Finds SSH servers that announce Erlang/OTP in their software banner. Unit 42 notes CVE-2025-32433 exposure is inferred from SSH versions tied to Erlang/OTP releases, and ET Open keys its banner rule on the same \"Erlang/\" string. Use it to build an inventory, then check versions.\nreferences:\n    - https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/\n    - https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules\nauthor: vuln2shell\ndate: 2026-10-23\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2025-32433\nlogsource:\n    product: zeek\n    service: ssh\ndetection:\n    selection:\n        server|contains: 'Erlang/'\n    condition: selection\nfalsepositives:\n    - Patched Erlang/OTP SSH servers also match; compare the version against the fixed releases\nlevel: low","logSource":"Zeek ssh.log","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Exposure mapping only. Fixed releases: OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20.","tested":"untested"},{"id":"v2s-spl-zeek-erlang-ssh-server","title":"Erlang/OTP SSH servers in Zeek SSH logs","language":"spl","query":"(sourcetype=\"bro:ssh:json\" OR sourcetype=\"zeek:ssh\") server=\"*Erlang/*\"\n| eval dest=coalesce(dest, 'id.resp_h'), dest_port=coalesce(dest_port, 'id.resp_p')\n| stats count min(_time) as firstTime max(_time) as lastTime values(server) as server_banner by dest dest_port","logSource":"Zeek ssh.log in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Same logic as the Sigma rule. Adjust sourcetypes to your Zeek add-on.","tested":"untested"},{"id":"v2s-kql-tvm-cve-2025-32433","title":"Devices with CVE-2025-32433 in Defender Vulnerability Management","language":"kql","query":"DeviceTvmSoftwareVulnerabilities\n| where CveId == \"CVE-2025-32433\"\n| project DeviceName, OSPlatform, SoftwareVendor, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel","logSource":"Microsoft Defender Vulnerability Management (DeviceTvmSoftwareVulnerabilities)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","sourceDate":"2025-04-16","license":"CC0 1.0","origin":"vuln2shell","notes":"Exposure query. Embedded Erlang/OTP in appliances usually will not show up here.","tested":"untested"}],"detectionLinks":[{"title":"Unit 42: Erlang/OTP SSH vulnerability analysis and exploits observed in the wild","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","author":"Unit 42","date":"2025-08-11","note":"Describes pre-auth connection protocol messages (codes 80 and up) and reverse-shell payloads; PAN Threat ID 96163."},{"title":"ET Open: Potentially Vulnerable Cisco ConfD SSH Server Banner (sid 2061806)","url":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules","author":"Emerging Threats","date":"2025-06-26","note":"For Cisco products that embed Erlang/OTP SSH."},{"title":"Cisco multi-product Erlang/OTP advisory","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","author":"Cisco PSIRT","date":"2025-04-22"}],"retrohunt":{"summary":"Search network and Zeek SSH logs back to 1 May 2025 for Erlang/OTP SSH banners and for pre-authentication channel requests. Inventory listeners on ports beyond 22, including 2222.","lookback":{"from":"2025-05-01","basis":"first-attempt","rationale":"Unit 42's earliest observation of exploit attempts is 1 May 2025, with a spike from 1 to 9 May. Public PoC appeared 18 Apr 2025; if you were internet-exposed then, start earlier.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]},"logSources":[{"name":"Zeek ssh.log or equivalent SSH protocol logs","why":"Show server banners and pre-auth channel requests.","required":true},{"name":"IDS alerts for ET Open Erlang/OTP rules","why":"ET Open has banner and pre-auth channel-request rules.","required":false},{"name":"Host process inventory","why":"Finds Erlang SSH listeners that never hit the SIEM.","required":true}],"steps":[{"title":"Inventory Erlang/OTP SSH listeners","detail":"Search banners for Erlang/ and check non-standard ports such as 2222 used by some industrial components.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]},{"title":"Search for pre-authentication channel requests","detail":"Unit 42 describes exploit traffic sending SSH connection protocol messages (codes >= 80) before authentication.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]},{"title":"Look for reverse shells from those hosts","detail":"Unit 42 saw reverse-shell payloads delivered through the exploit.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]}],"queries":[{"id":"v2s-rh-spl-erlang-ssh","title":"Erlang/OTP SSH banners since 1 May 2025","language":"spl","query":"(sourcetype=\"bro:ssh:json\" OR sourcetype=\"zeek:ssh\") earliest=\"05/01/2025:00:00:00\" server=\"*Erlang/*\"\n| eval dest=coalesce(dest, 'id.resp_h'), dest_port=coalesce(dest_port, 'id.resp_p')\n| stats count min(_time) as firstTime max(_time) as lastTime values(server) as server_banner by dest, dest_port\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Zeek ssh.log in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Banner inventory; check each host's OTP version against the advisory.","tested":"untested","timeRange":"From 2025-05-01"},{"id":"v2s-rh-kql-erlang-tvm","title":"Hosts with CVE-2025-32433 still present","language":"kql","query":"DeviceTvmSoftwareVulnerabilities\n| where CveId == \"CVE-2025-32433\"\n| project DeviceName, OSPlatform, SoftwareVendor, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel","logSource":"Microsoft Defender Vulnerability Management","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","sourceDate":"2025-04-16","license":"CC0 1.0","origin":"vuln2shell","notes":"Exposure, not proof of exploitation.","tested":"untested","timeRange":"Current inventory"},{"id":"v2s-rh-logscale-erlang-ssh","title":"Erlang/OTP SSH banners","language":"logscale","query":"// Set the time picker to start 2025-05-01\n/#type=ssh/ Erlang/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Zeek or IDS SSH logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2025-05-01"}],"thirdPartyQueries":[{"title":"ET Open: Potentially Vulnerable Cisco ConfD SSH Server Banner","url":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules","author":"Proofpoint ET Open","date":"2025-06-26","language":"suricata","license":"ET Open","origin":"vendor","note":"Banner and pre-auth rules; already linked from Detection."},{"title":"YARA for vulnerable Erlang BEAM","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_erlang_otp_ssh_cve_2025_32433.yar","author":"Florian Roth","date":null,"language":"yara","license":"see source","origin":"vendor","note":"Disk inventory of BEAM files."}],"artefacts":[{"kind":"network","value":"SSH banner containing Erlang/","detail":"Identifies the vulnerable library.","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11"},{"kind":"network","value":"SSH channel requests before authentication","detail":"Exploit traffic shape.","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11"},{"kind":"process","value":"Unexpected reverse shells from hosts running Erlang SSH","detail":"Post-exploitation Unit 42 observed.","sourceUrl":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","sourceDate":"2025-08-11"}],"iocs":[],"iocNote":"Unit 42 published sample reverse-shell payloads in its analysis. Use that post rather than copying them here.","hitMeaning":[{"level":"attempt","detail":"Pre-auth channel requests or IDS alerts against an Erlang SSH listener."},{"level":"likely-compromise","detail":"A reverse shell or unexpected process from that host after the attempt."},{"level":"confirmed-compromise","detail":"Interactive access or planted persistence on the host."}],"nextSteps":[{"title":"Upgrade or firewall the SSH server","detail":"Move to OTP-27.3.3, 26.2.5.11 or 25.3.2.20, or disable the SSH server until patched.","links":[{"label":"Erlang advisory","href":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2"}]},{"title":"Check vendor appliances","detail":"Cisco and others shipped product-specific fixes; the host OS OpenSSH patch does not cover Erlang SSH."}],"limits":["Many OT devices never send Zeek-quality SSH logs.","Banner alone is exposure, not compromise."],"sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"All users running the Erlang/OTP SSH server are impacted, regardless of OTP version, until they are on a patched release. GHSA-37cp-fgq5-7wc2 (16 Apr 2025): OTP affected >= 17.0 (versions prior to 17.0 also likely affected); patched OTP 27.3.3, 26.2.5.11, 25.3.2.20. ssh application affected >= 3.0.1; patched ssh 5.2.10, 5.1.4.8, 4.15.3.12. Host OpenSSH patches do not cover this library. Listeners often are not on TCP/22.","checks":[{"id":"v2s-aia-erlang-otp-ssh-version-1","kind":"version","title":"OTP release on hosts that run Erlang","detail":"GHSA patched versions: OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20. Affected OTP >= 17.0; prior to 17.0 likely also affected. erlang:system_info(otp_release) is the major (17, 25, 26, 27) only. Confirm the full OTP_VERSION via the package or the releases file the install actually uses.","command":"erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell; dpkg-query -W -f='${Package} ${Version}\\n' 'erlang*' 2>/dev/null; rpm -qa 'erlang*' 2>/dev/null","affectedMeans":"An Erlang/OTP SSH server is enabled AND OTP is older than 27.3.3 / 26.2.5.11 / 25.3.2.20 on that major, or ssh app older than 5.2.10 / 5.1.4.8 / 4.15.3.12. If the SSH server is running, GHSA says assume you are affected until you prove a patched build.","fixedMeans":"OTP 27.3.3+ or 26.2.5.11+ or 25.3.2.20+ (or later on that major) with the matching patched ssh app, or the SSH server is not running and not reachable. Embedded Cisco/NetApp builds need the product advisory, not the host erlang package.","notes":"erl -eval showing only \"27\" does not prove 27.3.3. Read the package NVR or the OTP_VERSION file shipped by that install. Do not invent a one-liner that was not on the advisory.","sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"}]},{"id":"v2s-aia-erlang-otp-ssh-config-2","kind":"config","title":"Erlang/OTP SSH server actually enabled","detail":"GHSA Am I Affected: all users running the Erlang/OTP SSH server are impacted. If your application provides SSH access using the Erlang/OTP SSH library, assume you are affected. Inventory listeners and product SSH features, not only host sshd.","command":"ss -lntp 2>/dev/null | grep -E 'beam|epmd|erlang'; ps -ef | grep -E '[b]eam|[e]rlang'; dpkg-query -W -f='${Package} ${Version}\\n' 'erlang*' 2>/dev/null","affectedMeans":"A process is offering SSH with an Erlang/OTP SSH library (banner SSH-2.0-Erlang/...) on any port, or a product listed in Cisco cisco-sa-erlang-otp-ssh-xyZZy is on an unfixed release.","fixedMeans":"No Erlang SSH listener, or OTP/ssh at the patched versions, or the vendor product is on a listed fixed release. Cisco 22 Apr 2025: several products have no fix planned (Ultra Services Platform, Small Business RV, iNode Manager).","notes":"Unit 42 11 Aug 2025: services seen on ports including 22, 830, 2022, and 2222. Do not inventory TCP/22 only.","sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"},{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","date":"2025-04-22","publisher":"Cisco"}]},{"id":"v2s-aia-erlang-otp-ssh-exposure-3","kind":"exposure","title":"Erlang SSH banners in your ranges (inventory only)","detail":"Catalog Shodan query SSH-2.0-Erlang (checked 23 Oct 2026). Censys 18 Apr 2025: services.software vendor Erlang product SSH. Censys: banner often shows the ssh app version (example SSH-2.0-Erlang/4.9.1.3) not the OTP version; 4.9.1.3 mapped to OTP 22.3.4.17 on the OTP versions tree. Banner is exposure, not proof of unpatched.","command":"shodan search '\"SSH-2.0-Erlang\" net:<your-range>' ; shodan search '\"SSH-2.0-Erlang\" org:\"<your org>\"'","affectedMeans":"A host in your range presents SSH-2.0-Erlang and you have not confirmed OTP 27.3.3 / 26.2.5.11 / 25.3.2.20 (or patched ssh 5.2.10 / 5.1.4.8 / 4.15.3.12) or a vendor-fixed embed.","fixedMeans":"No Erlang SSH banner in the range, or confirmed patched OTP/ssh / vendor release. Censys warns backports and custom builds can make a banner mismatch the real state.","notes":"Censys Platform query: host.services.software:(vendor:\"Erlang\" and product:\"SSH\") scoped to your asset inventory, not the open internet. Unit 42 Xpanse: 275 hosts / 326 services 16 Apr-9 May 2025.","sources":[{"url":"https://censys.com/advisory/cve-2025-32433/","date":"2025-04-18","publisher":"Censys"},{"url":"https://www.shodan.io/search?query=%22SSH-2.0-Erlang%22","date":"2026-10-23","publisher":"Shodan (catalog check)"},{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]}],"limits":["erl -eval otp_release is the major only. You still need the patch-level OTP_VERSION or package NVR.","Host OpenSSH 9.8p1 does not fix Erlang/OTP SSH.","Cisco 22 Apr 2025 (updated 11 Jun 2025): some listed products accept the unauthenticated channel request but Cisco says they are not vulnerable to RCE due to product configuration. That is a Cisco product statement, not a reason to skip OTP hosts you run yourself.","Censys banner-to-OTP mapping is inferred from the versions tree and can be wrong after backports."],"sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"},{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","date":"2025-04-22","publisher":"Cisco"},{"url":"https://censys.com/advisory/cve-2025-32433/","date":"2025-04-18","publisher":"Censys"},{"url":"https://www.shodan.io/search?query=%22SSH-2.0-Erlang%22","date":"2026-10-23","publisher":"Shodan (catalog check)"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"The OTP advisory documents disabling the SSH server or firewalling it until you upgrade to 27.3.3, 26.2.5.11, or 25.3.2.20. Cisco product embeds are a separate advisory.","items":[{"title":"Disable the Erlang/OTP SSH server until patched","detail":"GHSA-37cp-fgq5-7wc2 Mitigation, 16 Apr 2025: temporary workaround is to disable the SSH server until you upgrade to OTP-27.3.3 / 26.2.5.11 / 25.3.2.20. CVE record uses the same sentence. Unit 42 11 Aug 2025 repeats disable if you cannot patch.","limits":"Removes remote OTP SSH management. Does not patch the library; a later re-enable on an old build brings the bug back. Cisco's product advisory header says no workarounds available for the Cisco embeds; do not assume you can flip an OTP flag on ConfD/NSO/StarOS. Prefer the patched OTP or the vendor image.","verify":"Local listen table (ss -lntp) and process list show no beam/OTP SSH listener. Banner SSH-2.0-Erlang is gone from your scoped inventory. Application config that started ssh:daemon is off. Do not send SSH probes to test the bug.","source":{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"}},{"title":"Firewall / prevent network access to the OTP SSH port","detail":"GHSA 16 Apr 2025: or prevent access via firewall rules. Unit 42: restrict access to trusted sources only. This is the other half of the vendor temporary workaround.","limits":"Only as good as the rule set. Unit 42: listeners appear on 22, 830, 2022, 2222 and others; a rule for TCP/22 is not enough. Embedded management planes may use a different VRF or out-of-band path. Cisco product advisory does not publish a global firewall workaround.","verify":"Read the host or network firewall policy (iptables -L / nft list ruleset / vendor ACL show) and confirm the OTP SSH ports you inventoried are not reachable from untrusted zones. Confirm with your existing internal scan inventory, not a new exploit probe.","source":{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Block the Erlang SSH listener from untrusted networks and upgrade OTP. Public reporting covers scanning and OT-network attempts. No public filesystem persistence path is indexed here.","containment":[{"title":"Block the Erlang SSH listener from untrusted networks","detail":"Same control as the vendor workaround, used as containment if you saw pre-auth channel requests or a reverse shell. Unit 42: 70% of their May 2025 detections were on firewalls protecting OT networks.","sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"},{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]},{"title":"Treat a confirmed shell as host (or appliance) compromise","detail":"GHSA impact: unauthorized access and manipulation of sensitive data, or DoS. Rebuild or replace the appliance image after the vendor fix. Host OpenSSH patch is irrelevant.","generic":true,"sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"}]}],"rotate":[{"item":"Credentials, keys, and session secrets stored on the OTP host or appliance (including OT/NMS accounts that host could reach)","reason":"Unauthenticated RCE on the SSH library. Unit 42 saw reverse-shell payloads and DNS OAST callbacks, which implies command execution. No public report lists a specific stolen secret type. Rotate as for root/service RCE on that device.","generic":true,"sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]}],"evidence":[{"title":"SSH banners containing Erlang/ and the port list","detail":"Preserve Zeek ssh.log / inventory showing server Erlang/ on 22, 830, 2022, 2222 and any other port Unit 42 or your scan table recorded. Censys example banner form SSH-2.0-Erlang/<ssh-app-version>.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"},{"url":"https://censys.com/advisory/cve-2025-32433/","date":"2025-04-18","publisher":"Censys"}]},{"title":"Pre-authentication SSH connection protocol messages (codes >= 80)","detail":"Unit 42 11 Aug 2025: exploit traffic sends connection protocol messages that should only be processed after authentication. Preserve IDS hits (ET Open / PAN threat ID 96163 / Cisco Snort 1:64788) from 1 May 2025 (Unit 42 earliest attempt) or 18 Apr 2025 if you were exposed when the public PoC appeared.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]},{"title":"Reverse shells and DNS OAST from the OTP host","detail":"Unit 42: reverse-shell payloads (one example used 146.103.40.203:6667) and inet:gethostbyname lookups under dns.outbound.watchtowr.com. IOC list on that post also includes 194.165.16.71. Preserve outbound conntrack and DNS logs. Do not copy the raw shell one-liners into defender copy.","sources":[{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"}]}],"sources":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","publisher":"Erlang/OTP"},{"url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","publisher":"Unit 42"},{"url":"https://censys.com/advisory/cve-2025-32433/","date":"2025-04-18","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Check Point","title":"CPAI-2025-0221 Erlang/OTP Remote Code Execution (CVE-2025-32433)","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0221.html","date":"2025-04-28","cve":"CVE-2025-32433"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2025-04-18","url":"https://www.snort.org/advisories/talos-rules-2025-04-18","date":"2025-04-18","cve":"CVE-2025-32433"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2025-32433","url":"https://www.fortiguard.com/search?q=CVE-2025-32433&engine=1","date":"2025-04-22","cve":"CVE-2025-32433"},{"vendor":"Juniper","title":"SSH:OPENSSH:ERLANG-OTP-SSH-BYP","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.SSH:OPENSSH:ERLANG-OTP-SSH-BYP.html","date":"2025-08-11","cve":"CVE-2025-32433"},{"vendor":"Palo Alto Networks","title":"Erlang/OTP CVE-2025-32433 analysis","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","cve":"CVE-2025-32433"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.23.27","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.23.27.html","date":"2025-04-22","cve":"CVE-2025-32433"}],"coverage":[{"title":"Unauthenticated Remote Code Execution in Erlang/OTP SSH","publisher":"Erlang/OTP","url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","date":"2025-04-16","type":"vendor"},{"title":"Multiple Cisco Products Unauthenticated RCE in Erlang/OTP SSH Server","publisher":"Cisco","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","date":"2025-04-22","type":"vendor"},{"title":"Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild","publisher":"Unit 42","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","date":"2025-08-11","type":"research"}],"posts":[],"research":[{"title":"Erlang/OTP GHSA-37cp-fgq5-7wc2","url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","authors":"Erlang/OTP","date":"2025-04-16"},{"title":"NVD CVE-2025-32433","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32433","authors":"NVD","date":"2025-04-16"},{"title":"Cisco multi-product advisory","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","authors":"Cisco PSIRT","date":"2025-04-22"},{"title":"Unit 42 exploitation analysis","url":"https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/","authors":"Unit 42","date":"2025-08-11"},{"title":"oss-security disclosure thread","url":"https://www.openwall.com/lists/oss-security/2025/04/16/2","authors":"oss-security","date":"2025-04-16"}],"impact":{"kind":"shared-component","component":"Erlang/OTP SSH server library","matrixNote":"Many network and orchestration products embed Erlang/OTP. Patch status is product-specific even when the host OS OpenSSH package is current.","downstream":[{"product":"Erlang/OTP","vendor":"Erlang/OTP Project","type":"cms-app","status":"affected","versions":"27.3.3 / 26.2.5.11 / 25.3.2.20","vendorStatement":{"date":"16 Apr 2025","url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","quote":"Patched versions 27.3.3, 26.2.5.11, 25.3.2.20. Affected versions >= 17.0."}},{"product":"Cisco ConfD / ConfD Basic","vendor":"Cisco","type":"network-security","status":"affected","versions":"7.7.19.1 / 8.0.17.1 / 8.1.16.2 / 8.2.11.1 / 8.3.8.1 / 8.4.4.1","vendorStatement":{"date":"22 Apr 2025","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","quote":"ConfD, ConfD Basic CSCwo83759 fixed releases listed in the Cisco advisory."}},{"product":"Cisco Network Services Orchestrator (NSO)","vendor":"Cisco","type":"network-security","status":"affected","versions":"5.7.19.1 / 6.1.16.2 / 6.2.11.1 / 6.3.8.1 / 6.4.x fixes","vendorStatement":{"date":"22 Apr 2025","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","quote":"Network Services Orchestrator (NSO) CSCwo83796 fixed releases listed in the Cisco advisory."}},{"product":"Cisco ASR 5000 Series Software (StarOS) / Ultra Packet Core","vendor":"Cisco","type":"network-security","status":"affected","versions":"2025.03 (Jul 2025)","vendorStatement":{"date":"22 Apr 2025","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","quote":"ASR 5000 Series Software (StarOS) and Ultra Packet Core CSCwo83806 fixed release availability 2025.03 (Jul 2025)."}},{"product":"Cisco Ultra Services Platform","vendor":"Cisco","type":"network-security","status":"affected","versions":"No fix planned","vendorStatement":{"date":"22 Apr 2025","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","quote":"Ultra Services Platform CSCwo83750: No fix planned."}},{"product":"Cisco Small Business RV Series Routers","vendor":"Cisco","type":"network-security","status":"affected","versions":"No fix planned (end of software maintenance)","vendorStatement":{"date":"22 Apr 2025","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","quote":"Small Business RV Series Routers: No fix planned. These routers have reached end of software maintenance."}},{"product":"NetApp products","vendor":"NetApp","type":"nas-consumer","status":"affected","versions":"See NTAP-20250425-0001","vendorStatement":{"date":"25 Apr 2025","url":"https://security.netapp.com/advisory/ntap-20250425-0001/","quote":"NetApp advisory NTAP-20250425-0001 referenced from NVD for CVE-2025-32433."}}]},"pocs":[{"title":"ProDefense/CVE-2025-32433","url":"https://github.com/ProDefense/CVE-2025-32433","source":"ProDefense","validationStatus":"validated","validationDate":"2025-04-18","notes":"Public repository created 18 Apr 2025 and referenced from NVD."}],"_feed":{"page":"https://vuln2shell.com/vulns/erlang-otp-ssh","json":"https://vuln2shell.com/vulns/erlang-otp-ssh.json","iocsCsv":"https://vuln2shell.com/vulns/erlang-otp-ssh/iocs.csv","stix":"https://vuln2shell.com/vulns/erlang-otp-ssh/stix.json"}}