Latest Erlang/OTP SSH vulnerability: CVE-2025-32433 #
Certain versions of the Erlang/OTP (Open Telecom Platform) embedded SSH server contain a vulnerability in their handling of SSH protocol messages. Successfully exploiting this vulnerability would allow an attacker to execute arbitrary code with the privileges of the Erlang process.
This vulnerability has been assigned CVE-2025-32433 and has been rated highly critical with a CVSS score of 10.0.
Are updates available? #
The Erlang project has released updates that address these vulnerabilities. Note that the embedded SSH component can be updated independently of the overall OTP platform, and thus the version numbers for the embedded SSH component are tracked separately from the overall library.
How do I find potentially vulnerable versions of the Erlang/OTP SSH server with runZero? #
Vulnerable services can be found by navigating to the Software Inventory and using the following query:
_asset.protocols:ssh AND vendor:="Erlang" AND product:="SSH" AND ((version:>=5.2.0 AND version:<5.2.10) OR (version:>4.0.0.0 AND version:<4.15.3.12) OR (version:>5.1.0.0 AND version:<5.1.4.7))
