Erlang/OTP SSH: Unauthenticated RCE (CVE-2025-32433)

What to do

1. Find every process that runs an Erlang SSH daemon: grep your code and releases for ssh:daemon and scan for SSH banners on ports like 22, 830, 2022 and 2222
2. Upgrade to OTP-27.3.3, 26.2.5.11, 25.3.2.20 or later and rebuild releases that bundle ERTS
3. Apply vendor firmware fixes for appliances (check Cisco advisory cisco-sa-erlang-otp-ssh-xyZZy and your other vendors)
4. Until patched, disable the Erlang SSH server or firewall it to trusted management networks
5. Replace end-of-maintenance devices with no fix planned (Cisco names some RV Series routers)

How to check if you are affected or compromised

• Check the running OTP version: erl -noshell -eval 'io:format("~s~n",[erlang:system_info(otp_release)]), halt().' and the ssh app version via application:which_applications()
• Look for unexpected child processes, reverse shells or DNS callbacks from Erlang VM (beam.smp) processes
• Review SSH daemon logs for channel or exec requests that arrive before any successful authentication
• Watch for the IOCs reported by Unit 42 (e.g. 146.103.40[.]203:6667)

What happened#

On April 16, 2025, the Erlang/OTP team published GHSA-37cp-fgq5-7wc2 for CVE-2025-32433. The SSH server that ships in OTP's ssh application mishandled SSH protocol messages exchanged during authentication. An unauthenticated attacker could use this to run arbitrary code on the host. The advisory rates it CVSS 3.1 10.0 and maps it to CWE-306 (missing authentication for critical function). The bug was found by researchers at Ruhr University Bochum: Fabian Bäumer, Marcel Maehren, Marcus Brinkmann and Jörg Schwenk.

The code runs with the privileges of the Erlang VM process. The CVE record lists fixes in OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. The workaround is to disable the SSH server or firewall it.

Who is affected#

Affected systems are anything running an OTP SSH daemon from OTP 17.0 (ssh 3.0.1) up to the fixed releases. Most Erlang and Elixir web apps never start ssh:daemon, and OpenSSH on the same host is not involved. The bigger exposure is in products where the Erlang SSH server is a management interface. Cisco's advisory, first published April 22, 2025, lists ConfD, Network Services Orchestrator, ASR 5000/StarOS and Ultra Cloud Core components, Enterprise NFV Infrastructure Software, and some RV Series small-business routers. Those RV routers are past end of software maintenance and get no fix. Unit 42 notes that Erlang's native SSH is common in OT and 5G gear. Between April 16 and May 9, 2025, it counted 275 publicly routable hosts exposing 326 Erlang/OTP SSH services, on ports including 22, 830, 2022 and 2222.

Do you really need to act?#

For a typical Elixir or Phoenix web app that doesn't use SSH, there is nothing to do beyond normal OTP upgrades. The risk is in appliances, which can expose an Erlang SSH service on a non-standard port without anyone knowing it is Erlang. Exploitation is real. Unit 42 saw its first attempts on May 1, 2025, and recorded 3,376 signature hits by early May. About 70 percent came from firewalls protecting OT networks, and payloads included reverse shells. Cisco says it became aware of attempted exploitation in June 2025. CISA's catalog snapshot shows the CVE added to KEV on June 9, 2025, while Cisco's revision history gives June 11.

A year and a half later, upstream patches are routine. The open question is whether vendor firmware was updated on boxes nobody looks at. The verdict is check-exposure. If you find a reachable, unpatched Erlang SSH daemon, treat it as act-now.

What to do now#

1. Inventory. Search code and releases for ssh:daemon, and scan management networks for SSH services on 22, 830, 2022 and 2222 that are not OpenSSH.
2. Upgrade OTP to 27.3.3, 26.2.5.11, 25.3.2.20 or later, and rebuild any release that bundles ERTS. A host OTP upgrade does not fix a vendored runtime.
3. Apply vendor firmware for appliances. Start with the Cisco advisory and ask other network, telecom and OT vendors directly.
4. Until patched, disable the daemon or restrict it to a management VLAN or jump host.
5. Replace end-of-maintenance devices that will never get a fix.

How to tell if you were hit#

Check the runtime with erl -noshell -eval 'io:format("~s~n",[erlang:system_info(otp_release)]), halt().', and check the ssh application version. Exploitation needs no credentials, so authentication logs will not show it. Instead, look for unexpected child processes, outbound shells or DNS lookups originating from beam.smp. Unit 42 reported a reverse shell to 146.103.40[.]203 on port 6667, plus out-of-band DNS probes used to test for blind RCE. On appliances, compare running configuration and local accounts against a known-good baseline.

Timeline#

• Apr 16, 2025 — Erlang/OTP advisory and fixed releases published.
• Apr 22, 2025 — Cisco publishes its advisory for affected products.
• May 1, 2025 — First exploitation attempts seen by Unit 42; peaks through May 9.
• Jun 9, 2025 — CISA adds CVE-2025-32433 to KEV (Cisco cites Jun 11).

Vulnerability records

• CVE-2025-32433 · KEV 2025-06-09 · Erlang/OTP is a set of libraries for the Erlang programming language.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE Program — CVE-2025-32433 record (JSON) cveawg.mitre.org
2. Erlang/OTP — GHSA-37cp-fgq5-7wc2: Unauthenticated Remote Code Execution in Erlang/OTP SSH github.com
3. Cisco — Erlang/OTP SSH Server Remote Code Execution Vulnerability Affecting Cisco Products sec.cloudapps.cisco.com
4. Palo Alto Networks Unit 42 — Erlang/OTP CVE-2025-32433 unit42.paloaltonetworks.com