What is CVE-2025-32433?

CVE-2025-32433 is a critical-severity vulnerability in Erlang Otp, classified under Missing Authentication for Critical Function. CVSS score: 10.0/10. Published 2025-04-16.

How severe is CVE-2025-32433?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Is CVE-2025-32433 known to be exploited?

Yes. CVE-2025-32433 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-06-09), indicating it is being actively exploited. 90 public proof-of-concept repositories are indexed.

Auth bypass in Erlang Otp

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting…

Vulnerability class: Broken Authentication

EPSS: 0.628 (98.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Erlang Otp — versions >= OTP-27.0-rc1, < OTP-27.3.3, >= OTP-26.0-rc1, < OTP-26.2.5.11, < OTP-25.3.2.20

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2025-06-09. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2025-06-30.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 (x_refsource_CONFIRM)
https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 (x_refsource_MISC)
https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f (x_refsource_MISC)
https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-32433?: CVE-2025-32433 is a critical-severity vulnerability in Erlang Otp, classified under Missing Authentication for Critical Function. CVSS score: 10.0/10. Published 2025-04-16.
How severe is CVE-2025-32433?: Critical severity. CVSS v3 base score is 10.0 out of 10.
Is CVE-2025-32433 known to be exploited?: Yes. CVE-2025-32433 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-06-09), indicating it is being actively exploited. 90 public proof-of-concept repositories are indexed.