erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: April 16, 2025

1 editorial brief and 1 known exploited (cisa kev) addition.

All digests · RSS · Markdown

Take stock

  • Check exposure: Erlang/OTP SSH: Unauthenticated RCE (CVE-2025-32433). Teams running Erlang/Elixir apps that start the OTP ssh daemon, and owners of network, telecom or OT appliances built on Erlang (for example Cisco ConfD, NSO, StarOS components).
  • Do you run any of these? SonicWall SMA100 Appliances. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-05-07.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-32433

Erlang/OTP SSH: Unauthenticated RCE (CVE-2025-32433)

The OTP fix is 18 months old, but the bug hides inside appliances and OT gear that patch slowly; inventory anything exposing an Erlang SSH daemon rather than assuming your servers' OpenSSH covers you.

Must act: Teams running Erlang/Elixir apps that start the OTP ssh daemon, and owners of network, telecom or OT appliances built on Erlang (for example Cisco ConfD, NSO, StarOS components).

Can relax: Erlang/Elixir apps that never call ssh:daemon, and hosts whose SSH is OpenSSH; OpenSSH was not affected.

  1. Find every process that runs an Erlang SSH daemon: grep your code and releases for ssh:daemon and scan for SSH banners on ports like 22, 830, 2022 and 2222
  2. Upgrade to OTP-27.3.3, 26.2.5.11, 25.3.2.20 or later and rebuild releases that bundle ERTS
  3. Apply vendor firmware fixes for appliances (check Cisco advisory cisco-sa-erlang-otp-ssh-xyZZy and your other vendors)

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2021-20035SonicWall SMA100 Appliances
SonicWall SMA100 Appliances OS Command Injection Vulnerability		2025-05-07

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.