CVE-2025-32433

The error results from improper handling of SSH protocol messages (CWE-306 — missing required authentication for critical functions). An attacker can send crafted SSH protocol messages to the vulnerable server, thereby bypassing authentication mechanisms. This allows execution of arbitrary system commands in the context of the SSH server process without valid login credentials.

An attacker gains full, unauthenticated control over the vulnerable system, enabling execution of arbitrary commands, reading and modifying data, and potentially compromising the entire Erlang/OTP-based infrastructure. The vulnerability has scope beyond the directly attacked environment (CVSS Scope: Changed).

Immediately update Erlang/OTP to version OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20. As a temporary workaround until patches are deployed, disable the Erlang/OTP-based SSH server or restrict access using firewall rules. Cisco product users should follow the vendor's recommendations regarding patch availability for their specific platforms.

Erlang/OTP in all versions before OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 when running an SSH server from the OTP library. The vulnerability affects, among others, Cisco devices: Inode Manager, NCS 1001, NCS 1004, RV340W Firmware, Ultra Packet Core.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.