CVE-2025-32433

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32433
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 Patch
https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f Patch
https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 Patch
https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/16/2 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/18/1 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/18/2 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/18/6 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/19/1 Mailing List
https://security.netapp.com/advisory/ntap-20250425-0001/ Third Party Advisory
https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_packet_core:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*
History

12 Jun 2025, 16:05

Type Values Removed Values Added
First Time Cisco rv260w Firmware
Cisco staros
Cisco rv160
Cisco rv260w
Cisco rv160w
Cisco rv260p Firmware
Cisco rv340 Firmware
Cisco rv260
Cisco rv340
Cisco ncs 1001
Cisco inode Manager
Cisco rv345 Firmware
Cisco rv340w Firmware
Cisco ncs 1004
Cisco network Services Orchestrator
Cisco rv345p
Cisco smart Phy
Cisco ultra Services Platform
Cisco rv340w
Cisco ncs 1002
Cisco rv345
Cisco
Cisco cloud Native Broadband Network Gateway
Cisco ncs 2000 Shelf Virtualization Orchestrator Module
Cisco ncs 2000 Shelf Virtualization Orchestrator Firmware
Cisco confd Basic
Cisco rv260p
Cisco enterprise Nfv Infrastructure Software
Cisco optical Site Manager
Cisco rv260 Firmware
Cisco rv160 Firmware
Cisco ultra Cloud Core
Cisco ultra Packet Core
Cisco rv345p Firmware
Cisco rv160w Firmware
CPE cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_packet_core:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*

11 Jun 2025, 21:15

Type Values Removed Values Added
First Time Erlang erlang\/otp
Erlang
CPE cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
References () https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 - () https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 - Patch
References () https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f - () https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f - Patch
References () https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 - () https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 - Patch
References () https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 - () https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/04/16/2 - () http://www.openwall.com/lists/oss-security/2025/04/16/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/18/1 - () http://www.openwall.com/lists/oss-security/2025/04/18/1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/18/2 - () http://www.openwall.com/lists/oss-security/2025/04/18/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/18/6 - () http://www.openwall.com/lists/oss-security/2025/04/18/6 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/19/1 - () http://www.openwall.com/lists/oss-security/2025/04/19/1 - Mailing List
References () https://security.netapp.com/advisory/ntap-20250425-0001/ - () https://security.netapp.com/advisory/ntap-20250425-0001/ - Third Party Advisory
References () https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py - () https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py - Exploit

25 Apr 2025, 23:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250425-0001/ -

21 Apr 2025, 17:15

Type Values Removed Values Added
References
  • () https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py -
Summary
  • (es) Erlang/OTP es un conjunto de librerías para el lenguaje de programación Erlang. En versiones anteriores a OTP-27.3.3, OTP-26.2.5.11 y OTP-25.3.2.20, un servidor SSH podía permitir a un atacante realizar una ejecución remota de código (RCE) sin autenticación. Al explotar una falla en la gestión de mensajes del protocolo SSH, un atacante podría obtener acceso no autorizado a los sistemas afectados y ejecutar comandos arbitrarios sin credenciales válidas. Este problema está corregido en las versiones OTP-27.3.3, OTP-26.2.5.11 y OTP-25.3.2.20. Una solución temporal consiste en deshabilitar el servidor SSH o impedir el acceso mediante reglas de firewall.

19 Apr 2025, 16:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/04/19/1 -

19 Apr 2025, 02:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/04/18/6 -

18 Apr 2025, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/04/18/2 -

18 Apr 2025, 05:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/04/18/1 -

16 Apr 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 22:15

Updated : 2025-06-12 16:05

NVD link : CVE-2025-32433

Mitre link : CVE-2025-32433

CVE.ORG link : CVE-2025-32433

JSON object : View

Products Affected

cisco

  • ncs_2000_shelf_virtualization_orchestrator_module
  • rv340
  • ncs_1002
  • enterprise_nfv_infrastructure_software
  • ultra_packet_core
  • network_services_orchestrator
  • rv260_firmware
  • rv260
  • rv345_firmware
  • rv160w_firmware
  • rv345
  • ncs_1001
  • rv160w
  • optical_site_manager
  • ncs_2000_shelf_virtualization_orchestrator_firmware
  • rv260w_firmware
  • staros
  • rv345p
  • rv160
  • ultra_cloud_core
  • confd_basic
  • rv260p
  • rv340w_firmware
  • rv340_firmware
  • inode_manager
  • rv260w
  • ncs_1004
  • cloud_native_broadband_network_gateway
  • rv345p_firmware
  • smart_phy
  • rv260p_firmware
  • ultra_services_platform
  • rv160_firmware
  • rv340w

erlang

  • erlang\/otp
CWE
CWE-306

Missing Authentication for Critical Function