CVE-2025-32433
CriticalActively ExploitedErlang/OTP SSH Server Unauthenticated Remote Code Execution
ACTIVELY EXPLOITED IN THE WILD
PERIMETER DEVICE RISK
10
CVSS v3.1 Base Score
Critical severity — Immediate action required
AV: Network AC: LowAuth: None
CVE-2025-32433 is a maximum-severity (CVSS 10.0) unauthenticated RCE in Erlang/OTP SSH. An attacker can achieve full system compromise without any credentials. Erlang/OTP SSH is embedded in many OT-relevant systems including CouchDB, RabbitMQ, and various IoT/ICS management platforms. Active exploitation has been confirmed in the wild. Immediate patching is critical.
Status
Actively Exploited
Complexity
Low
Auth Required
No
Initial Access
SSH service exposed to network — no authentication required
Threat Actors / APT Groups
UNC3944Scattered Spider
Known Techniques
- Crafted SSH_MSG_CHANNEL_REQUEST before authentication completes
- Pre-auth message injection bypassing SSH handshake state machine
- Payload delivery via SSH protocol message fields
Published:2025-03-18
Modified:2025-04-02
Vendor:Erlang/OTP
CWE:CWE-306
Missing Authentication for Critical Function
Risk Summary
Overall RiskCritical
ExploitationActively Exploited
DetectionHigh coverage
Detection Rate97%
Rules Available3
Industry Sectors
Threat Actors
UNC3944
Scattered Spider