Erlang/OTP SSH CVE-2025-32433 (CVSS 10, unauthenticated remote code execution, CISA KEV): am I affected through Erlang, Elixir or a product that embeds the OTP SSH server, and which versions fix it?

What it is: CVE-2025-32433 is a flaw in the SSH server built into Erlang/OTP's ssh application. The server didn't enforce the order of SSH protocol stages, so a client could send connection-level messages before logging in and run code without any credentials. It was disclosed in April 2025, a public exploit appeared within days, and CISA added it to the Known Exploited Vulnerabilities catalog in June 2025. Many network and telecom products embed Erlang/OTP, so the affected surface goes well beyond Erlang developers. Am I affected: - Anything that runs the Erlang/OTP SSH daemon (ssh:daemon), directly or through Elixir, before OTP-27.3.3, OTP-26.2.5.11 or OTP-25.3.2.20. The code runs with the privileges of the Erlang VM, often root on appliances. - Plain OpenSSH servers are not affected; only the Erlang implementation is. Applications that use Erlang but don't start its SSH server aren't exposed to this bug. - Vendors such as Cisco and Ericsson published their own advisories for products embedding it; check those for appliance fixes. - Check the OTP version: erl -noshell -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' plus the ssh application version, or your vendor's product version. Fix: 1. Upgrade to OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20 or any later release (current OTP 28 releases are fixed), rebuild releases that bundle ERTS, and redeploy. 2. For embedded products, apply the vendor's update. 3. Until then, disable the Erlang SSH daemon if you don't need it, or restrict access to its port with a firewall to trusted management hosts only. After: look for unexpected processes started by the Erlang VM (beam.smp), new files or cron entries, and connections to the SSH port from unknown sources since April 2025; if found, treat the host as compromised. Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-32433 https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 https://securityscorecard.com/blog/erlang-erlang-otp-ssh-server-missing-authentication-for-critical-function-vulnerability-cve-2025-32433/