CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Source

https://github.com/darses/CVE-2025-32433

Associated Vulnerability

Title:Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVE-2025-32433)
Description:Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Description

Security research on Erlang/OTP SSH CVE-2025-32433.

Readme

# Security research on Erlang/OTP SSH CVE-2025-32433

Python exploit Proof-of-Concept CVE-2025-32433 Unauthenticated Remote Code Execution in Erlang/OTP SSH. I also have a [banner grabbing Nuclei template](https://github.com/darses/nuclei-templates/blob/main/erlang-otp-ssh-detect.yaml) and a [Nuclei RCE](https://github.com/darses/nuclei-templates/blob/main/cve-2025-32433.yaml) check.

The Suricata and Zeek IDS logs are in order based on a succesful Paramiko attack, two regular OpenSSH_9.8 connections without attack, two succesful attacks using [ProDefense/CVE-2025-32433](https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py) and one succesful attack using [CVE-2025-32433.yaml by iamnoooob,rootxharsh,pdresearch](https://github.com/projectdiscovery/nuclei-templates/pull/11960/files). Suricata ran with only my own custom rules in `suricata.rules`.

The Suricata rules only detect unencrypted channel open/request messages, which are assumed to be sent unauthenticated.

I have not tested the rules against realistic traffic logs.

## HASHH
- `a42d62b326c107401e08c1ee316f28b6` CVE-2025-32433.yaml by iamnoooob,rootxharsh,pdresearch
- `ca3cc8a7d31514fa9b48636eaec05a78` ProDefense/CVE-2025-32433
- `a2de0f306611e0957be704f5b0e35a82` Paramiko script

File Snapshot


 [4.0K]  /data/pocs/1368129bee0c3355b378a7bb908638c49a663404
├── [4.3K]  bro.log
├── [1.2K]  CVE-2025-32433.py
├── [ 12K]  eve.json
├── [1.2K]  README.md
└── [ 745]  suricata.rules

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!