CVE-2025-32433
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated r...
Affects 52 products across 5 vendors.
Software does not perform any authentication for functionality that requires a verified identity.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in the SSH server of Erlang/OTP, a programming language used in various industrial control systems, allows an unauthenticated attacker to execute arbitrary code remotely. Successful exploitation could lead to full control of affected systems, potentially disrupting industrial processes and compromising safety systems. Organizations using affected versions of Erlang/OTP in their OT environments are at significant risk.
BSID: BS-2025-GLOBAL-254014-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-32433?
What is the CVSS score for CVE-2025-32433?
Is CVE-2025-32433 actively exploited?
How do I remediate CVE-2025-32433?
What systems are affected by CVE-2025-32433?
What NERC-CIP standard applies to CVE-2025-32433?
What IEC 62443 requirement maps to CVE-2025-32433?
| CVE ID | CVE-2025-32433 |
|---|---|
| BSID | BS-2025-GLOBAL-254014-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2025-04-16 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 100% |
| Weakness (CWE) | |
| Verticals | |
| Domains | |
| Source | NVD |
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the SSH server implementation of Erlang/OTP. An unauthenticated attacker can send a specially crafted SSH protocol message to the server, which triggers a flaw in the message handling code. This flaw allows the attacker to execute arbitrary code on the server without needing valid credentials. The attacker must have network access to the SSH server, typically over TCP port 22. Post-exploitation, the attacker gains full control of the affected system, enabling them to manipulate industrial processes, steal sensitive data, or cause physical damage. This is a pre-authentication remote code execution (RCE) vulnerability, making it highly dangerous in OT environments.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Cisco | Rv345 (device & firmware) | No version listed by source |
| Cisco | Ultra Services Platform | No version listed by source |
| Cisco | Enterprise Nfv Infrastructure Software | < 4.18 |
| Cisco | Network Services Orchestrator | < 5.7.19.1 ≥ 5.8, < 6.1.16.2 ≥ 6.2, < 6.2.11.1 ≥ 6.3, < 6.3.8.1 ≥ 6.4.2, < 6.4.4.1 ≥ 6.4, < 6.4.1.1 |
| Cisco | Rv340W (device & firmware) | No version listed by source |
| Cisco | Rv340 (device & firmware) | No version listed by source |
| Cisco | Staros | < 2025.03 |
| Cisco | Rv345P (device & firmware) | No version listed by source |
| Cisco | Rv160 (device & firmware) | No version listed by source |
| Cisco | Rv160W (device & firmware) | No version listed by source |
| Cisco | Rv260 (device & firmware) | No version listed by source |
| Cisco | Rv260P (device & firmware) | No version listed by source |
| Cisco | Rv260W (device & firmware) | No version listed by source |
| Cisco | Smart Phy | < 25.2 |
| Cisco | Ultra Cloud Core | < 2025.03.1 |
| Cisco | Confd Basic | < 7.7.19.1 ≥ 8.0.18, < 8.1.16.2 ≥ 8.2, < 8.2.11.1 ≥ 8.3, < 8.3.8.1 ≥ 8.4, < 8.4.4.1 |
| Cisco | Inode Manager | No version listed by source |
| Cisco | Cloud Native Broadband Network Gateway | < 2025.03.1 |
| Cisco | Ultra Packet Core | < 2025.03 |
| Cisco | Optical Site Manager | < 25.2.1 |
| Cisco | Ncs 2000 Shelf Virtualization Orchestrator Firmware | < 25.1.1 |
| Debian | Debian Linux | 11.0 |
| Erlang | Erlang/Otp | < 25.3.2.20 ≥ 26.0, < 26.2.5.11 ≥ 27.0, < 27.3.3 |
| Schneider-Electric | Galaxy Vl (device & firmware) | ≤ 18.5.0 |
| Schneider-Electric | Galaxy Vs (device & firmware) | ≤ 6.118.0 |
| Siemens | Scalance Xcm324 | < 3.3 |
| Siemens | Scalance Xcm328 | < 3.3 |
| Siemens | Scalance Xcm332 | < 3.3 |
| Siemens | Scalance Xrh334 | < 3.3 |
| Siemens | Scalance Xrm334 | < 3.3 |
| Siemens | Scalance Xr-300 (device & firmware) | < 3.3 |
| Siemens | Scalance Xr-500 (device & firmware) | < 3.3 |
| Siemens | Ruggedcom Rst2428P (device & firmware) | < 3.3 |
| Siemens | Scalance Xch328 | < 3.3 |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Cisco Ncs 1001, Cisco Ncs 1002, Cisco Ncs 1004, Cisco Ncs 2000 Shelf Virtualization Orchestrator Module
| CISA known-exploited | ● Active Exploitation Confirmed (added 2025-06-09) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Disable the SSH server on affected systems or restrict access to trusted IP addresses using firewall rules. Implement network segmentation to isolate affected systems from the broader OT network. Ensure that only authorized personnel can access the SSH server. Apply these controls at the Purdue Model Level 2/3 boundary.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
CIP-007-R1 requires the identification and disabling of unnecessary ports and services. The vulnerable SSH server represents an unnecessary service on BES Cyber Assets if remote management is not required.
IEC 62443 SR 3.5 (Input Validation) is directly violated. The SSH server fails to validate the input data correctly, leading to a buffer overflow and potential remote code execution.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | e6d11302e5dcf3444bddeb9e124b9bdf5672884185c9d87ae59b3a53c259db4daf08b250a8aff76c404cac1df5fcc9455d1570305ec04c468343ea29d3ef1bbe |
This Vulnerability Is Being Actively Exploited
CVE-2025-32433 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →