Latest Erlang/OTP SSH vulnerability: CVE-2025-32433 #
Certain versions of the Erlang/OTP (Open Telecom Platform) embedded SSH server contain a vulnerability in their handling of SSH protocol messages. Successfully exploiting this vulnerability would allow an attacker to execute arbitrary code with the privileges of the Erlang process.
This vulnerability has been assigned CVE-2025-32433 and has been rated highly critical with a CVSS score of 10.0.
Cisco has announced that multiple Cisco products contain a vulnerable version of the Erlang/OTP SSH server, and these products expose the vulnerable service:
- Cisco ConfD and ConfD Basic (Cisco bug ID CSCwo83759)
- Cisco Network Services Orchestrator (NSO) (Cisco bug ID CSCwo83796)
Patches for these products have not yet been released, and it appears that there are at least 3,000 exposed and likely vulnerable systems on the Internet.
Are updates available? #
The Erlang project has released updates that address these vulnerabilities.
Note that the embedded SSH component can be updated independently of the overall OTP platform, and thus the version numbers for the embedded SSH component are tracked separately from the overall library.
Also, please note that while the Erlang project has released updates, vendors who embed the vulnerable service will need to provide updates individually for their products.
How do I find potentially vulnerable versions of the Erlang/OTP SSH server with runZero? #
Vulnerable services can be found by navigating to the Software Inventory and using the following query:
_asset.protocols:ssh AND vendor:="Erlang" AND product:="SSH" AND ((version:>=5.2.0 AND version:<5.2.10) OR (version:>4.0.0.0 AND version:<4.15.3.12) OR (version:>5.1.0.0 AND version:<5.1.4.7))
Vulnerable Cisco ConfD installations can be found by navigating to the Services Inventory and using the following query:
_asset.protocols:ssh AND protocol:ssh AND banner:="SSH-2.0-ConfD"
