Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Source
Associated Vulnerability
Title:Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVE-2025-32433)
Description:Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Description
python script to find vulnerable targets of CVE-2025-32433 
Readme
# erl_mouse version 1.1

##### Alright, I've improved several things to increase chances of finding a vulnerable device or network.  Most are not public facing, have been patched, or are so oscure that it can be difficult to find a target. 
Nevertheless, we persist.  You can now scan every IP address in china by choosing "Type Presets" and then choose from the amount of blocks you want to scan at one time.  There are over 300 million IP addresses so take it easy.  Haha.
There are other more tailored categories to choose from that you may have a better chance with.  RabbitMQ and CouchDB IP blocks will typically use the vulnerable SSH service.  Okay, good luck with ERL MOUSE (v1.1)

  
python script to find vulnerable targets of CVE-2025-32433 

This script scans CIDR blocks to find vulnerable targets of CVE-2025-32433.  

Using Masscan as the workhorse of the operation, erl_mouse continues the discovery by creating and parsing a JSON file of all IP addresses with port 22 open.  The JSON parses for Erlang/OTP SSH banner regex & vulnerability thresholds provding only viable targets.

Findings will print in terminal and also provide a .CSV and .JSON

In theory, at least.

Although there are presets to scan [by several countries (more will be added), by type (telecom, cloud, even IOT if you are inside that network), etc.], your best bet is probaly entering in your own set of CIDR.


*For education and security research*

### Requirements

- Python3
- Masscan
- china_ip_ranges.txt needs to be in same directory folder as erl_mouse_v1-1.py
File Snapshot

[4.0K] /data/pocs/5cdc82ea93ca9fe4e889cd59dfc293ff39b71377 ├── [170K] china_ip_ranges.txt ├── [ 11K] erl_mouse_v1-1.py ├── [1.0K] LICENSE └── [1.5K] README.md 0 directories, 4 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →