CVE-2025-32433: Erlang Erlang/OTP authentication bypass in SSH Server

CVE-2025-32433 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2025-06-09

Erlang/OTP is a widely used programming framework that provides the foundation for many networking products, including those from Cisco and NetApp. A critical security flaw in its SSH server component allows an attacker to bypass authentication and take full control of the system. This could lead to complete data theft, service disruption, or the installation of malware on affected infrastructure. This vulnerability is known to be actively exploited in the wild.

Technologies: Erlang/OTP. Vendors: Cisco, Erlang.

Quick answers

Is CVE-2025-32433 exploited in the wild?
Yes. CVE-2025-32433 is known to be exploited in the wild, first recorded on 9 June 2025. Treat it as urgent.
How severe is CVE-2025-32433?
Critical severity, with a CVSS score of 10, published 9 June 2025.
Which products and versions are affected?
Cisco Cloud Native Broadband Network Gateway Prior to 2025.03.1; Cisco Smart PHY Prior to 25.2; Cisco StarOS Prior to 2025.03; Erlang/OTP SSH Server Prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20.
Is there a fix for CVE-2025-32433?
A patch was published on 2025-06-09. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32433 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-32433?
Check whether you run Cisco Cloud Native Broadband Network Gateway, Cisco Smart PHY, Cisco StarOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication for critical function (CWE-306) exists in the Erlang/OTP SSH server component. The vulnerability stems from a flaw in how SSH protocol messages are handled, allowing a remote, unauthenticated attacker to bypass security controls. By sending specially crafted protocol messages, an attacker can execute arbitrary commands with the privileges of the SSH service. This issue is confirmed to be exploited in the wild and affects multiple downstream vendors that integrate Erlang/OTP. Patches are available in Erlang/OTP versions 27.3.3, 26.2.5.11, and 25.3.2.20.

Affected products

  • Erlang Erlang/OTP SSH Server Prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20
  • Cisco StarOS Prior to 2025.03
  • Cisco Smart PHY Prior to 25.2
  • Cisco Cloud Native Broadband Network Gateway Prior to 2025.03.1

Timeline

  • 2025-06-09: disclosed
  • 2025-06-09: kev added: Added to CISA KEV catalog
  • 2025-06-09: advisory
  • 2025-06-09: patched

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.