Critical Erlang/OTP SSH Vulnerability Allows Unauthenticated Remote Code Execution

2025-04-17

A critical vulnerability (CVE-2025-32433) has been discovered in the Erlang/OTP SSH server, allowing unauthenticated remote code execution (RCE). Versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 are affected. Attackers can exploit a flaw in SSH protocol message handling to gain unauthorized access and execute arbitrary commands without credentials. Patches are available; update to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 or later.

Development