CVE-2025-32433

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 98,8%

Kerentanan Missing Authentication for Critical Function pada erlang/otp, cisco confd basic +21 lainnya. Skor CVSS 3.1 10.0 (Critical) menurut github.com. Masuk katalog KEV CISA pada 9 Juni 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Rincian

Terbit di NVD

16 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

98,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Masuk KEV

9 Juni 2025

Tenggat CISA

30 Juni 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 advisory vendor
• https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 patch
• https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f patch
• https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433 pemerintah AS
• https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250425-0001/ advisory pihak ketiga
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy advisory pihak ketiga
• https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py exploit
• http://www.openwall.com/lists/oss-security/2025/04/16/2 mailing list
• http://www.openwall.com/lists/oss-security/2025/04/18/1 mailing list
• http://www.openwall.com/lists/oss-security/2025/04/18/2 mailing list
• http://www.openwall.com/lists/oss-security/2025/04/18/6 mailing list
• http://www.openwall.com/lists/oss-security/2025/04/19/1 mailing list