Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVSS 10.0 · CriticalBuzz score 71.4KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 71.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 26.4 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
26.4
13 evidence mentions in the snapshot
Diversity score
20.0
7 sources across 3 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
13 source links · newest first
  • Thus Spoke…The Gentlemen0day Fans

    we cannot confirm whether the targeted machines were actually vulnerable to the exact vulnerabilities they referenced. `CVE-2024-55591– FortiOS management interface` This vulnerability affects the FortiOS management interface and fits directly into their broader focus on Fortinet appliances as high‑value initial access points. While the chats do not sh

    newsresearch.checkpoint.comMay 13, 2026, 1:01 PM
  • Hackers exploit unpatched Erlang/OTP to crack OT firewallsCSO Online

    A max-severity remote code execution (RCE) issue affecting the SSH daemon (sshd) of Erlang’s Open Telecom Platform (OTP) was exploited by attackers in the wild, days after a patch was issued in April 2025. According to Unit 42, attackers began exploiting the flaw, tracked as CVE-2025-32433, as an N-day vulnerability between May 1 to May […]

    newswww.csoonline.comAug 13, 2025, 11:18 AM
  • OT Networks Targeted in Widespread Exploitation of Erlang/OTP VulnerabilitySecurityWeek

    The recently patched Erlang/OTP flaw CVE-2025-32433 has been exploited since early May, shortly after its existence came to light.

    newswww.securityweek.comAug 12, 2025, 8:59 AM
  • Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the WildUnit42

    CVE-2025-32433 allows for remote code execution in sshd for certain versions of Erlang programming language’s OTP. We reproduced this CVE and share our findings.

    vendorunit42.paloaltonetworks.comAug 11, 2025, 10:00 AM
  • U.S. CISA adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: The CVE-2025-32433 flaw is a […]

    newssecurityaffairs.comJun 10, 2025, 1:34 PM
  • ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Phoenix ContactSecurityWeek

    Industrial giants Siemens, Schneider Electric and Phoenix Contact have released ICS security advisories on the May 2025 Patch Tuesday.

    newswww.securityweek.comMay 14, 2025, 7:29 AM
  • Cisco Patches 35 Vulnerabilities Across Several ProductsSecurityWeek

    Cisco releases patches for 26 vulnerabilities in IOS and IOS XE software, including 17 critical- and high-severity bugs.

    newswww.securityweek.comMay 8, 2025, 9:52 AM
  • Week in review: MITRE ATT&CK v17.0 released, PoC for Erlang/OTP SSH bug is publicHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Released: MITRE ATT&CK v17.0, now with ESXi attack TTPs MITRE has released the latest version of its ATT&CK framework, which now also includes a new section (“matrix”) to cover the tactics, techniques and procedures (TTPs) used to target VMware ESXi hypervisors. PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) There are now several public proof-of-concept (PoC) exploits for … More →

    newswww.helpnetsecurity.comApr 27, 2025, 8:00 AM
  • Cisco Confirms Some Products Impacted by Critical Erlang/OTP FlawSecurityWeek

    Cisco is investigating the impact of the Erlang/OTP remote code execution vulnerability CVE-2025-32433 on its products.

    newswww.securityweek.comApr 24, 2025, 8:05 AM
  • PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433)Help Net Security

    There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. “All users running an SSH server based on the Erlang/OTP SSH library are likely to be affected by this vulnerability. If your application uses Erlang/OTP SSH to provide remote access, assume you are affected,” Ruhr University Bochum researchers, who discovered and reported the flaw, said. About CVE-2025-32433 Erlang/OTP SSH is a set of libraries … More →

    newswww.helpnetsecurity.comApr 22, 2025, 12:06 PM
  • Public exploits already available for a severity 10 Erlang SSH vulnerability; patch nowCSO Online

    Experts are urging enterprises to immediately patch an Erlang/OTP Secure Shell (SSH) vulnerability that allows unauthenticated attackers to gain full access to a device. The remote code execution (RCE) vulnerability (CVE-2025-32433) has a CVSS score of 10, the highest possible severity level. Many impacted devices are widely used in Internet of Things (IoT) and telecom […]

    newswww.csoonline.comApr 22, 2025, 1:31 AM
  • CVE-2025-32433Horizon3.ai

    Full RCE Vulnerability in Erlang/OTP

    exploithorizon3.aiApr 21, 2025, 11:20 AM
  • Critical Erlang/OTP SSH Flaw Exposes Many Devices to Remote HackingSecurityWeek

    Servers exposed to complete takeover due to CVE-2025-32433, an unauthenticated remote code execution flaw in Erlang/OTP SSH.

    newswww.securityweek.comApr 17, 2025, 12:14 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence