Public exploits are now available for a critical Erlang/OTP SSH vulnerability tracked as CVE-2025-32433, allowing unauthenticated attackers to remotely execute code on impacted devices. Now that public exploits are available, it is strongly advised that all devices running Erlang OTP SSH be upgraded immediately before threat actors compromise them. While it is unclear how many devices are utilizing the Erlang OTP's SSH daemon, over 600,000 IP addresses are running Erlang/OTP according to a Shodan query shared by Girnus. However, the situation has become more urgent, as multiple cybersecurity researchers have privately created exploits that achieve remote code execution on vulnerable devices. Researchers at the Ruhr University Bochum in Germany disclosed the flaw on Wednesday, warning that all devices running the daemon were vulnerable. "The issue is caused by a flaw in the SSH protocol message handling which allows an attacker to send connection protocol messages prior to authentication," reads a disclosure on the OpenWall vulnerability mailing list. "These are mostly CouchDB instances, CouchDB is implemented in Erlang and runs on the Erlang/OTP platform," the researcher explained in a chat about the public exploits. Now that public exploits are available, threat actors will soon begin scanning for vulnerable systems and exploiting them. The flaw was fixed in versions 25.3.2.10 and 26.2.4, but as the paltform is commonly used in telecom infrastructure, databases, and high-availability systems, it may not be easy to update devices immediately. Girnus confirmed to BleepingComputer that ProDefense's PoC is valid but was not able to successfully exploit Erlang/OTP SSH using the one posted to Pastebin. "SSH is the most commonly used remote access management protocol so I expect this combination to be widespread in critical infrastructure," Girnus told BleepingComputer. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. This includes Peter Girnus of the Zero Day Initiative and researchers from Horizon3, who said the flaw was surprisingly easy to exploit. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 19 Apr 2025 20:55:10 +0000