{"schemaVersion":3,"id":"CVE-2025-32433","aliases":["SUSE-SU-2025:1357-1","UBUNTU-CVE-2025-32433","USN-7443-1","USN-7443-2","USN-7443-3","DEBIAN-CVE-2025-32433"],"status":"published","duplicateOf":null,"title":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","description":"Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.","dates":{"published":"2025-04-16T21:34:37.457Z","modified":"2026-02-26T18:28:12.084Z","reserved":null,"kevAdded":["2025-06-09T00:00:00.000Z"],"kevDue":["2025-06-30T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":10,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":10,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.98786,"percentile":0.99926,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.031999999999998696,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.98754},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.98786,"percentile":0.99926}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98754,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.98786,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.98786,"percentile":0.99926}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-06-09T00:00:00.000Z","dueDate":"2025-06-30T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","description":"Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.","notes":[{"type":"text","value":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2"},{"type":"url","href":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","label":"sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-32433","label":"nvd.nist.gov/vuln/detail/CVE-2025-32433"}],"vendor":"Erlang","product":"Erlang/OTP","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-06-09T00:00:00.000Z","dueDate":"2025-06-30T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","description":"Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.","notes":[{"type":"text","value":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2"},{"type":"url","href":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","label":"sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-32433","label":"nvd.nist.gov/vuln/detail/CVE-2025-32433"}],"vendor":"Erlang","product":"Erlang/OTP","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_PRODEFENSE_CVE-2025-32433","name":"Cve 2025 32433","source":"github","url":"https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_SSH_SSH_ERLANGOTP_RCE","name":"Erlang OTP Pre-Auth RCE Scanner and Exploit","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/ssh/ssh_erlangotp_rce.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/ssh/ssh_erlangotp_rce","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"cisco","product":"cloud_native_broadband_network_gateway","name":"cloud native broadband network gateway","label":"cloud_native_broadband_network_gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2025.03.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.03.1","eol":null,"hubHref":"/vendor/cisco/cloud_native_broadband_network_gateway"},{"vendor":"cisco","product":"confd_basic","name":"confd basic","label":"confd_basic","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.7.19.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.18, < 8.1.16.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.2, < 8.2.11.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.3, < 8.3.8.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4, < 8.4.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.7.19.1 | ≥ 8.0.18, < 8.1.16.2 | ≥ 8.2, < 8.2.11.1 | ≥ 8.3, < 8.3.8.1 | ≥ 8.4, < 8.4.4.1","eol":null,"hubHref":"/vendor/cisco/confd_basic"},{"vendor":"cisco","product":"enterprise_nfv_infrastructure_software","name":"enterprise nfv infrastructure software","label":"enterprise_nfv_infrastructure_software","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.18","eol":null,"hubHref":"/vendor/cisco/enterprise_nfv_infrastructure_software"},{"vendor":"cisco","product":"inode_manager","name":"inode manager","label":"inode_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/inode_manager"},{"vendor":"cisco","product":"ncs_2000_shelf_virtualization_orchestrator_firmware","name":"ncs 2000 shelf virtualization orchestrator firmware","label":"ncs_2000_shelf_virtualization_orchestrator_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 25.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.1.1","eol":null,"hubHref":"/vendor/cisco/ncs_2000_shelf_virtualization_orchestrator"},{"vendor":"cisco","product":"network_services_orchestrator","name":"network services orchestrator","label":"network_services_orchestrator","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.7.19.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8, < 6.1.16.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2, < 6.2.11.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3, < 6.3.8.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4, < 6.4.1.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.2, < 6.4.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.7.19.1 | ≥ 5.8, < 6.1.16.2 | ≥ 6.2, < 6.2.11.1 | ≥ 6.3, < 6.3.8.1 | ≥ 6.4, < 6.4.1.1 | ≥ 6.4.2, < 6.4.4.1","eol":null,"hubHref":"/vendor/cisco/network_services_orchestrator"},{"vendor":"cisco","product":"optical_site_manager","name":"optical site manager","label":"optical_site_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 25.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.2.1","eol":null,"hubHref":"/vendor/cisco/optical_site_manager"},{"vendor":"cisco","product":"rv160_firmware","name":"rv160 firmware","label":"rv160_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv160"},{"vendor":"cisco","product":"rv160w_firmware","name":"rv160w firmware","label":"rv160w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv160w"},{"vendor":"cisco","product":"rv260_firmware","name":"rv260 firmware","label":"rv260_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv260"},{"vendor":"cisco","product":"rv260p_firmware","name":"rv260p firmware","label":"rv260p_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv260p"},{"vendor":"cisco","product":"rv260w_firmware","name":"rv260w firmware","label":"rv260w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv260w"},{"vendor":"cisco","product":"rv340_firmware","name":"rv340 firmware","label":"rv340_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv340"},{"vendor":"cisco","product":"rv340w_firmware","name":"rv340w firmware","label":"rv340w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv340w"},{"vendor":"cisco","product":"rv345_firmware","name":"rv345 firmware","label":"rv345_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv345"},{"vendor":"cisco","product":"rv345p_firmware","name":"rv345p firmware","label":"rv345p_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/rv345p"},{"vendor":"cisco","product":"smart_phy","name":"smart phy","label":"smart_phy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 25.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.2","eol":null,"hubHref":"/vendor/cisco/smart_phy"},{"vendor":"cisco","product":"staros","name":"staros","label":"staros","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2025.03","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.03","eol":null,"hubHref":"/vendor/cisco/staros"},{"vendor":"cisco","product":"ultra_cloud_core","name":"ultra cloud core","label":"ultra_cloud_core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2025.03.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.03.1","eol":null,"hubHref":"/vendor/cisco/ultra_cloud_core"},{"vendor":"cisco","product":"ultra_packet_core","name":"ultra packet core","label":"ultra_packet_core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2025.03","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.03","eol":null,"hubHref":"/vendor/cisco/ultra_packet_core"},{"vendor":"cisco","product":"ultra_services_platform","name":"ultra services platform","label":"ultra_services_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/ultra_services_platform"},{"vendor":"debian","product":"erlang","name":"erlang","label":"erlang","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/erlang","purlType":"deb","versions":[{"text":"< 1:25.2.3+dfsg-1+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:27.3.3+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:25.2.3+dfsg-1+deb12u1 | < 1:27.3.3+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"erlang","name":"erlang","label":"erlang","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/erlang","purlType":"deb","versions":[{"text":"< 1:22.2.7+dfsg-1ubuntu0.5","noFixRecorded":false,"fixedIn":null},{"text":"< 1:24.2.1+dfsg-1ubuntu0.4","noFixRecorded":false,"fixedIn":null},{"text":"< 1:25.3.2.8+dfsg-1ubuntu4.3","noFixRecorded":false,"fixedIn":null},{"text":"< 1:27.3+dfsg-1ubuntu1.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:18.3-dfsg-1ubuntu3.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:20.2.2+dfsg-1ubuntu2+esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:22.2.7+dfsg-1ubuntu0.5 | < 1:24.2.1+dfsg-1ubuntu0.4 | < 1:25.3.2.8+dfsg-1ubuntu4.3 | < 1:27.3+dfsg-1ubuntu1.1 | < 1:18.3-dfsg-1ubuntu3.1+esm1 | < 1:20.2.2+dfsg-1ubuntu2+esm1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.0","eol":{"isEol":true,"eolDate":"2026-08-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11","label":"11 (Bullseye)","eolFrom":"2026-08-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"11.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"erlang","product":"erlang\\/otp","name":"Erlang/OTP","label":"erlang\\/otp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 25.3.2.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.0, < 26.2.5.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 27.0, < 27.3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.3.2.20 | ≥ 26.0, < 26.2.5.11 | ≥ 27.0, < 27.3.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"erlang","label":"Erlang","category":"lang"}},"hubHref":"/vendor/erlang/erlangotp"},{"vendor":"erlang","product":"otp","name":"OTP","label":"otp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ OTP-27.0-rc1, < OTP-27.3.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ OTP-26.0-rc1, < OTP-26.2.5.11","noFixRecorded":false,"fixedIn":null},{"text":"< OTP-25.3.2.20","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ OTP-27.0-rc1, < OTP-27.3.3 | ≥ OTP-26.0-rc1, < OTP-26.2.5.11 | < OTP-25.3.2.20","eol":null,"hubHref":"/vendor/erlang/otp"},{"vendor":"opensuse","product":"erlang&distro=openSUSE Leap 15.6","name":"erlang","label":"erlang&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/erlang&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Enterprise Storage 7.1","name":"erlang","label":"erlang&distro=SUSE Enterprise Storage 7.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Enterprise Storage 7.1","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Module for Server Applications 15 SP6","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Module for Server Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Module for Server Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","name":"erlang","label":"erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Manager Proxy 4.3","name":"erlang","label":"erlang&distro=SUSE Manager Proxy 4.3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Manager Proxy 4.3","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang&distro=SUSE Manager Server 4.3","name":"erlang","label":"erlang&distro=SUSE Manager Server 4.3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang&distro=SUSE Manager Server 4.3","purlType":"rpm","versions":[{"text":"< 23.3.4.19-150300.3.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.3.4.19-150300.3.20.1","eol":null,"hubHref":null}],"affectedCount":42,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","label":"github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Vendor Advisory"]},{"url":"https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12","label":"github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12","hostname":"github.com","tags":["X Refsource MISC","Patch"]},{"url":"https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f","label":"github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f","hostname":"github.com","tags":["X Refsource MISC","Patch"]},{"url":"https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891","label":"github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891","hostname":"github.com","tags":["X Refsource MISC","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/16/2","label":"www.openwall.com/lists/oss-security/2025/04/16/2","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/18/1","label":"www.openwall.com/lists/oss-security/2025/04/18/1","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/18/2","label":"www.openwall.com/lists/oss-security/2025/04/18/2","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/18/6","label":"www.openwall.com/lists/oss-security/2025/04/18/6","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/19/1","label":"www.openwall.com/lists/oss-security/2025/04/19/1","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20250425-0001/","label":"security.netapp.com/advisory/ntap-20250425-0001/","hostname":"security.netapp.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","label":"lists.debian.org/debian-lts-announce/2025/04/msg00028.html","hostname":"lists.debian.org","tags":["Third Party Advisory"]},{"url":"https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py","label":"github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py","hostname":"github.com","tags":["Exploit"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","label":"sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy","hostname":"sec.cloudapps.cisco.com","tags":["Vendor Advisory","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251357-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-20251357-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1241300","label":"bugzilla.suse.com/1241300","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32433","label":"www.suse.com/security/cve/CVE-2025-32433","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2025-32433","label":"ubuntu.com/security/CVE-2025-32433","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32433","label":"www.cve.org/CVERecord?id=CVE-2025-32433","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7443-1","label":"ubuntu.com/security/notices/USN-7443-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7443-2","label":"ubuntu.com/security/notices/USN-7443-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7443-3","label":"ubuntu.com/security/notices/USN-7443-3","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-32433","label":"security-tracker.debian.org/tracker/CVE-2025-32433","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32433","label":"nvd.nist.gov/vuln/detail/CVE-2025-32433","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-4132-1","DSA-5906-1","SUSE-SU-2025:1356-1"],"duplicates":[],"related":["SUSE-SU-2025:1356-1"]},"timeline":[{"kind":"published","date":"2025-04-16T21:34:37.457Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-06-09T00:00:00.000Z","label":"Added to CISA KEV","detail":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-06-30T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-02-26T18:28:12.084Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T00:55:23.070Z","stale":false,"partial":false}}