CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Q: How do I fix CVE-2025-32433?

erlang\/otp: upgrade to 25.3.2.20, 26.2.5.11, 27.3.3; confd basic: upgrade to 7.7.19.1, 8.1.16.2, 8.2.11.1, 8.3.8.1, 8.4.4.1; network services orchestrator: upgrade to 5.7.19.1, 6.1.16.2, 6.2.11.1, 6.3.8.1, 6.4.1.1, 6.4.4.1. Exact commands for each OS are on this page.

Q: Is CVE-2025-32433 being exploited?

Yes. CVE-2025-32433 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2025-32433 affect?

CVE-2025-32433 affects erlang\/otp, confd basic, network services orchestrator. Severity is critical (CVSS 10.0). Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a

Q: How urgent is CVE-2025-32433?

Priority 98/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Patch now

CRITICAL 10.0EXPLOITEDREMOTEUPGRADEUPGRADEUPGRADE

CVE-2025-32433 is a critical-severity flaw (CVSS 10.0) affecting erlang\/otp, confd basic, network services orchestrator, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	98.9% (top 1%)
CISA exploited list	Yes, fix due 2025-06-30
Weakness	CWE-306
Published	2025-04-16
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: cisco · erlang

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-04-16 22:15 UTCPublished CVE record published
2025-06-09Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-06-30Deadline CISA due date for US federal agencies to patch
2026-06-17 09:11 UTCUpdated Record last modified

erlang erlang\/otp UPGRADE

Affected: < 25.3.2.20 · >= 26.0 and < 26.2.5.11 · >= 27.0 and < 27.3.3

Fixed in: 25.3.2.20, 26.2.5.11, 27.3.3

Safe to downgrade to: a release before 26.0

1. Check installed version

apt-cache policy erlangotp || rpm -q erlangotp || erlangotp --version

2. UPGRADE to 25.3.2.20 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade erlangotp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade erlangotp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 26.0 (Debian / Ubuntu)

apt-cache madison erlangotp sudo apt install erlangotp=<VERSION_BEFORE_26.0> sudo apt-mark hold erlangotp

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list erlangotp sudo dnf downgrade erlangotp-<VERSION_BEFORE_26.0> sudo dnf versionlock add erlangotp

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

cisco confd basic UPGRADE

Affected: < 7.7.19.1 · >= 8.0.18 and < 8.1.16.2 · >= 8.2 and < 8.2.11.1 · >= 8.3 and < 8.3.8.1 · >= 8.4 and < 8.4.4.1

Fixed in: 7.7.19.1, 8.1.16.2, 8.2.11.1, 8.3.8.1, 8.4.4.1

Safe to downgrade to: a release before 8.0.18

1. Check installed version

apt-cache policy confd-basic || rpm -q confd-basic || confd-basic --version

2. UPGRADE to 7.7.19.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade confd-basic

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade confd-basic

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0.18 (Debian / Ubuntu)

apt-cache madison confd-basic sudo apt install confd-basic=<VERSION_BEFORE_8.0.18> sudo apt-mark hold confd-basic

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list confd-basic sudo dnf downgrade confd-basic-<VERSION_BEFORE_8.0.18> sudo dnf versionlock add confd-basic

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

cisco network services orchestrator UPGRADE

Affected: < 5.7.19.1 · >= 5.8 and < 6.1.16.2 · >= 6.2 and < 6.2.11.1 · >= 6.3 and < 6.3.8.1 · >= 6.4 and < 6.4.1.1 · >= 6.4.2 and < 6.4.4.1

Fixed in: 5.7.19.1, 6.1.16.2, 6.2.11.1, 6.3.8.1, 6.4.1.1, 6.4.4.1

Safe to downgrade to: a release before 5.8

1. Check installed version

apt-cache policy network-services-orchestrator || rpm -q network-services-orchestrator || network-services-orchestrator --version

2. UPGRADE to 5.7.19.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade network-services-orchestrator

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade network-services-orchestrator

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 5.8 (Debian / Ubuntu)

apt-cache madison network-services-orchestrator sudo apt install network-services-orchestrator=<VERSION_BEFORE_5.8> sudo apt-mark hold network-services-orchestrator

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list network-services-orchestrator sudo dnf downgrade network-services-orchestrator-<VERSION_BEFORE_5.8> sudo dnf versionlock add network-services-orchestrator

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

cisco cloud native broadband network gateway UPGRADE

Affected: < 2025.03.1

Fixed in: 2025.03.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy cloud-native-broadband-network-gateway || rpm -q cloud-native-broadband-network-gateway || cloud-native-broadband-network-gateway --version

2. UPGRADE to 2025.03.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade cloud-native-broadband-network-gateway

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade cloud-native-broadband-network-gateway

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

cisco inode manager MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy inode-manager || rpm -q inode-manager || inode-manager --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

cisco smart phy UPGRADE

Affected: < 25.2

Fixed in: 25.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy smart-phy || rpm -q smart-phy || smart-phy --version

2. UPGRADE to 25.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade smart-phy

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade smart-phy

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · perl-WWW-OrangeHRM-Client · FIXED · 0.12.0-21.fc46 · FEDORA-2026-2d14efca09 · source

sudo dnf upgrade --advisory=FEDORA-2026-2d14efca09

Ubuntu 20.04 · erlang · FIXED · 1:22.2.7+dfsg-1ubuntu0.5

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:22.2.7+dfsg-1ubuntu0.5" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 22.04 · erlang · FIXED · 1:24.2.1+dfsg-1ubuntu0.4

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:24.2.1+dfsg-1ubuntu0.4" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · erlang · FIXED · 1:25.3.2.8+dfsg-1ubuntu4.3

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:25.3.2.8+dfsg-1ubuntu4.3" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.10 · erlang · FIXED · 1:25.3.2.12+dfsg-1ubuntu2.3

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:25.3.2.12+dfsg-1ubuntu2.3" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.04 · erlang · FIXED · 1:27.3+dfsg-1ubuntu1.1

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:27.3+dfsg-1ubuntu1.1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · erlang · FIXED · 1:25.2.3+dfsg-1+deb12u1

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:25.2.3+dfsg-1+deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · erlang · FIXED · 1:27.3.3+dfsg-1

sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:27.3.3+dfsg-1" && echo PATCHED || echo STILL-VULNERABLE

Alpine 3.21 · erlang · FIXED · erlang-26.2.5.11-r0

apk add --upgrade erlang apk info -v erlang

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: ProDefense/CVE-2025-32433 (142 stars)
GitHub PoC: omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC (16 stars)
GitHub PoC: m0usem0use/erl_mouse (7 stars)
GitHub PoC: 0x7556/CVE-2025-32433
GitHub PoC: 0xPThree/cve-2025-32433
Metasploit: Erlang OTP Pre-Auth RCE Scanner and Exploit

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-32433?

erlang\/otp: upgrade to 25.3.2.20, 26.2.5.11, 27.3.3; confd basic: upgrade to 7.7.19.1, 8.1.16.2, 8.2.11.1, 8.3.8.1, 8.4.4.1; network services orchestrator: upgrade to 5.7.19.1, 6.1.16.2, 6.2.11.1, 6.3.8.1, 6.4.1.1, 6.4.4.1. Exact commands for each OS are on this page.

Is CVE-2025-32433 being exploited?

Yes. CVE-2025-32433 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-32433 affect?

CVE-2025-32433 affects erlang\/otp, confd basic, network services orchestrator. Severity is critical (CVSS 10.0). Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a

How urgent is CVE-2025-32433?

Priority 98/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Cisco vulnerabilities

Related CVEs

CVE-2026-28808 CRITICAL 9.8 UPGRADE UPGRADE Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scrip
CVE-2026-32144 HIGH 7.4 UPGRADE UPGRADE Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP design
CVE-2026-32147 MEDIUM 4.3 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh
CVE-2026-28810 LOW 3.7 UPGRADE Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules
CVE-2026-49759 HIGH 8.2 UPGRADE UPGRADE Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attac

References

← Back to latest CVEs