CVE
CVE-2025-32433
- First Reported
- Mar 13, 2026
- Latest Reported
- Mar 13, 2026
CVE Enrichment
- CVSS
- 10.0 CRITICAL
- EPSS
- 98.79%
- EPSS Percentile
- 99.93%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- security-advisories@github.com
- Published
- 17-Apr-2025 05:15
- Last Modified
- 17-Jun-2026 16:11
- EPSS Date
- 2026-10-16
- CWE
- CWE-306
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:C /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2025-06-09
- Remediation Due
- 2025-06-30
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy ; https://nvd.nist.gov/vuln/detail/CVE-2025-32433
Affected Products / Versions
- erlang / erlang\/otp
Version / affected range: * · before (exclusive) 25.3.2.20
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* - erlang / erlang\/otp
Version / affected range: * · from (inclusive) 26.0 · before (exclusive) 26.2.5.11
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* - erlang / erlang\/otp
Version / affected range: * · from (inclusive) 27.0 · before (exclusive) 27.3.3
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* - cisco / confd_basic
Version / affected range: * · before (exclusive) 7.7.19.1
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* - cisco / confd_basic
Version / affected range: * · from (inclusive) 8.0.18 · before (exclusive) 8.1.16.2
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* - cisco / confd_basic
Version / affected range: * · from (inclusive) 8.2 · before (exclusive) 8.2.11.1
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* - cisco / confd_basic
Version / affected range: * · from (inclusive) 8.3 · before (exclusive) 8.3.8.1
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* - cisco / confd_basic
Version / affected range: * · from (inclusive) 8.4 · before (exclusive) 8.4.4.1
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · before (exclusive) 5.7.19.1
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · from (inclusive) 5.8 · before (exclusive) 6.1.16.2
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · from (inclusive) 6.2 · before (exclusive) 6.2.11.1
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · from (inclusive) 6.3 · before (exclusive) 6.3.8.1
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · from (inclusive) 6.4 · before (exclusive) 6.4.1.1
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / network_services_orchestrator
Version / affected range: * · from (inclusive) 6.4.2 · before (exclusive) 6.4.4.1
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* - cisco / cloud_native_broadband_network_gateway
Version / affected range: * · before (exclusive) 2025.03.1
cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:* - cisco / inode_manager
Version / affected range: -
cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:* - cisco / smart_phy
Version / affected range: * · before (exclusive) 25.2
cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:* - cisco / ultra_packet_core
Version / affected range: * · before (exclusive) 2025.03
cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:* - cisco / ultra_services_platform
Version / affected range: -
cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:* - cisco / staros
Version / affected range: * · before (exclusive) 2025.03
cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:* - cisco / optical_site_manager
Version / affected range: * · before (exclusive) 25.2.1
cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:* - cisco / ncs_2000_shelf_virtualization_orchestrator_firmware
Version / affected range: * · before (exclusive) 25.1.1
cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:* - cisco / enterprise_nfv_infrastructure_software
Version / affected range: * · before (exclusive) 4.18
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:* - cisco / ultra_cloud_core
Version / affected range: * · before (exclusive) 2025.03.1
cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:* - cisco / rv160w_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:* - cisco / rv260_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:* - cisco / rv160_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:* - cisco / rv260p_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:* - cisco / rv260w_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:* - cisco / rv340_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:* - cisco / rv340w_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:* - cisco / rv345_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:* - cisco / rv345p_firmware
Version / affected range: -
cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- and create exploits for them at a much faster rate than ever before. An early example of this was CVE-2025-32433 in April 2025, which was a vulnerability that would normally require a deep understanding of the Twenty Years of Cloud Security Research: From Cloud Foundations to AI
People (10)
Vendors (1)
Products (11)
Tools (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.