A critical remote code execution vulnerability in Erlang/OTP’s SSH implementation has security teams scrambling to patch affected systems after researchers confirmed the development of a proof-of-concept exploit. The vulnerability, tracked as CVE-2025-32433 and assigned the maximum possible CVSS score of 10.0, allows attackers to execute arbitrary code without authentication, potentially leading to complete system compromise. Security experts have described the vulnerability as “extremely critical” and warned that it could allow threat actors to perform actions such as installing ransomware or stealing sensitive data. Security researchers at Horizon3’s Attack Team have already reproduced the vulnerability and developed a proof-of-concept exploit. This vulnerability allows malicious actors with network access to hosts running an Erlang/OTP SSH server to execute unauthenticated remote code. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With confirmation that the vulnerability is easily exploitable and the likelihood of public exploits appearing imminently, the window for remediation is rapidly closing for organizations with vulnerable systems exposed. A team of security researchers publicly disclosed the vulnerability in April 2025. The ease of exploitation has raised alarms among security professionals, with concerns that widespread attacks could emerge rapidly once public exploits become available. This vulnerability is particularly dangerous because Erlang is widely deployed in critical infrastructure, including telecom equipment from major vendors, as well as IoT and operational technology (OT) environments.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Apr 2025 03:00:07 +0000