“Severe Erlang/OTP SSH Flaw Enables Unauthenticated Remote Code Execution”

A critical vulnerability (CVE-2025-32433) in Erlang/OTP’s SSH implementation allows unauthenticated attackers to execute arbitrary code on vulnerable systems, earning the maximum CVSS score of 10.0.

The flaw exposes high-availability systems in telecom, IoT, and distributed computing environments to full compromise.

Technical Analysis

The vulnerability stems from improper handling of SSH protocol messages, enabling attackers to send connection protocol messages before completing authentication.

This bypasses critical security checks, allowing:

erlang%% Simplified vulnerable code logic
handle_ssh_msg(Msg, State) ->
  case Msg of
    {ssh_cm, _, _} -> process_pre_auth_cm(Msg); % Flawed pre-auth handling
    _ -> standard_handler(Msg)
  end.

Researchers from Ruhr University Bochum identified that this design flaw permits remote code execution (RCE) in the SSH daemon’s context.

When the daemon runs with root privileges (common in telecom infrastructure), attackers gain full system control.

Risk Factor Analysis

Metric	Value
CVSS Score	10.0 (Critical)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N)
User Interaction	None (UI:N)
Scope	Changed (S:C)
Confidentiality Impact	High (C:H)
Integrity Impact	High (I:H)
Availability Impact	High (A:H)
CWE-ID	CWE-306

Affected Systems

• Erlang/OTP SSH servers using versions ≤25.3.2.19, ≤26.2.5.10, and ≤27.3.2
• Cisco and Ericsson devices are leveraging Erlang for high-availability services
• Industrial control systems (ICS) and IoT devices with exposed SSH ports

Mitigation Strategies

1. Immediate patching to:
   • OTP-25.3.2.20
   • OTP-26.2.5.11
   • OTP-27.3.3
2. Temporary workarounds: bash# Block SSH port 22 access except for management IPs iptables -A INPUT -p tcp --dport 22 -s 192.0.2.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP
3. Network segmentation of Erlang-based systems from untrusted networks

Industry Response

Mayuresh Dani of Qualys warns: “This vulnerability enables threat actors to deploy ransomware or exfiltrate sensitive data from mission-critical systems”.

Ericsson’s advisory emphasizes that “all SSH implementations using Erlang/OTP are affected regardless of version”.

The Erlang/OTP team confirmed that patches eliminate the pre-authentication message handling flaw through improved state validation.

Organizations must prioritize patching given Erlang’s prevalence in telecom infrastructure and the vulnerability’s wormable potential.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates