- Security researchers find a 10/10 error in Erlang/OTP SSH
- Horizon3 Attack Team says the error is “surprisingly easy” to take advantage of
- A patch is available so users need to update now
Erlang/OTP SSH, a set of libraries for Erlang programming language, bears a vulnerability in the maximum severity that allows for the performance of remote code and is “surprisingly easy” to exploit researchers warn.
A team of cybersecurity scientists from Ruhr University Bochum (Germany) recently discovered the incorrect handling of pre-authentication protocol message errors affecting all versions of Erlang/OTP SSH. It is traced as CVE-2025-32433 and has a severity of 10/10 (critical).
Erlang/OTP SSH is a module in Erlang/OTP Standard Library, providing support for implementing Secure Shell (SSH) clients and servers in Erlang applications.
Remote code execution
Erlang is a functional programming language and Runtime system designed to build up very simultaneously, distributed and fault-tolerant systems. It was originally developed by Ericsson for use in telecommunications, but has been extended to messaging systems, databases and other applications where uptime and scalability are critical.
“The problem is caused by an error in the SSH Protocol Message Management, which allows an attacker to send connection protocol messages before approval,” reads a warning of Openwall vulnerability email.
Shortly after the news broke, security researchers from the Horizon3 attack team tried to reproduce the error and found it was “surprisingly easy”, which should be cause for concern.
“Just finished reproducing CVE-2025-32433 and putting together a quick POC utilization-surprisingly,” the team said at X. “would not be shocked if public POCs soon start falling. If you track this, now is the time to intervene.”
Taking action would mean using the patch that is now available and which reduces the risk. Since all older versions are vulnerable, all users are advised to upgrade to versions 25.3.2.10 and 26.2.4.
Threat actors are more active in the short window between a patch that is released and is used by users. Most organizations are not as diligent when it comes to patching, giving cyber criminals a relatively easy utilization friend.
Via Bleeping computer
