https://nvd.nist.gov/vuln/detail/CVE-2025-32433 You are viewing this page in an unauthorized frame window. This is a potential security issue, you are being redirected to https://nvd.nist.gov You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality. U.S. flag An official website of the United States government Here's how you know Dot gov Official websites use .gov A .gov website belongs to an official government organization in the United States. Https Secure .gov websites use HTTPS A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. National Institute of Standards and Technology NVD MENU * General Expand or Collapse NVD Dashboard News and Status Updates FAQ Visualizations Legal Disclaimer * Vulnerabilities Expand or Collapse Search & Statistics Weakness Types Legacy Data Feeds Vendor Comments CVMAP * Vulnerability Metrics Expand or Collapse CVSS v4.0 Calculators CVSS v3.x Calculators CVSS v2.0 Calculator * Products Expand or Collapse CPE Dictionary CPE Search CPE Statistics SWID * Developers Expand or Collapse Start Here Request an API Key Vulnerabilities Products Data Sources Terms of Use * Contact NVD * Other Sites Expand or Collapse Checklist (NCP) Repository Configurations (CCE) 800-53 Controls SCAP Validated Tools SCAP USGCB * Search Expand or Collapse Vulnerability Search CPE Search Information Technology Laboratory National Vulnerability Database National Vulnerability Database NVD National Vulnerability Database 1. Vulnerabilities CVE-2025-32433 Detail Awaiting Analysis --------------------------------------------------------------------- This CVE record has been marked for NVD enrichment efforts. Description Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules. Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings: NIST CVSS score NIST: NVD N/A NVD assessment not yet provided. CVSS 3.x Severity and Vector Strings: NIST CVSS score NIST: NVD Base Score: N/A NVD assessment not yet provided. Nist CVSS score does not match with CNA score CNA: GitHub, Inc. Base Score: 10.0 CRITICAL Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS 2.0 Severity and Vector Strings: National Institute of Standards and Technology NIST: NVD Base Score: N/A NVD assessment not yet provided. References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. Hyperlink Resource http://www.openwall.com/lists/oss-security/2025/04/16/2 http://www.openwall.com/lists/oss-security/2025/04/18/1 http://www.openwall.com/lists/oss-security/2025/04/18/2 https://github.com/erlang/otp/commit/ 0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 https://github.com/erlang/otp/commit/ 6eef04130afc8b0ccb63c9a0d8650209cf54892f https://github.com/erlang/otp/commit/ b1924d37fd83c070055beb115d5d6a6a9490b891 https://github.com/erlang/otp/security/advisories/ GHSA-37cp-fgq5-7wc2 Weakness Enumeration CWE-ID CWE Name Source CWE-306 Missing Authentication for Critical Function GitHub, Inc. Change History 4 change records found show changes CVE Modified by CVE 4/18/2025 2:15:53 PM Action Type Old New Value Value http://www.openwall.com/lists/oss-security/2025/04/18/2 Added Reference CVE Modified by CVE 4/18/2025 1:15:33 AM Action Type Old New Value Value http://www.openwall.com/lists/oss-security/2025/04/18/1 Added Reference CVE Modified by CVE 4/16/2025 6:15:14 PM Action Type Old New Value Value http://www.openwall.com/lists/oss-security/2025/04/16/2 Added Reference New CVE Received from GitHub, Inc. 4/16/2025 6:15:14 PM Action Type Old New Value Value Record truncated, showing 500 of 584 characters. View Entire Change Record Added Description Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary w AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CVSS V3.1 CWE-306 Added CWE https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 Added Reference https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f Added Reference https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 Added Reference https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 Added Reference Quick Info CVE Dictionary Entry: CVE-2025-32433 NVD Published Date: 04/16/2025 NVD Last Modified: 04/18/2025 Source: GitHub, Inc. * twitter (link is external) * facebook (link is external) * linkedin (link is external) * youtube (link is external) * rss * govdelivery (link is external) National Institute of Standards and Technology logo National Institute of Standards and Technology logo HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 (301) 975-2000 Webmaster | Contact Us | Our Other Offices Incident Response Assistance and Non-NVD Related Technical Cyber Security Questions: US-CERT Security Operations Center Email: soc@us-cert.gov Phone: 1-888-282-0870 Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov