CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Title:Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVE-2025-32433)
Description:Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Erlang/OTP SSH 远程代码执行漏洞

# Erlang/OTP SSH 远程代码执行漏洞，问题根源在于SSH协议的消息处理机制存在缺陷，攻击者可在认证完成前发送连接协议消息。值得注意的是，该漏洞影响所有运行SSH服务器组件的Erlang/OTP版本，与底层系统版本无关。
LINUX下编译：gcc CVE-2025-32433.c -o sshexp

 [4.0K]  /data/pocs/ddffc400eaa286979f4ae85f69d9d33ba1a54a11
├── [6.5K]  CVE-2025-32433.c
└── [ 331]  README.md

0 directories, 2 files