CVE-2025-32433: Pre-Authentication Command Execution in Erlang/OTP SSH Server

HERMES

HERMES THREAT SCORE & EMBEDDED SSH SERVER EXPOSURE

Target: Erlang/OTP SSH Server (prior to 25.3.2.16 / 26.2.5.7 / 27.2.2)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-32433 at an HTS of 98 (CRITICAL SEVERITY). This architectural flaw in the Erlang/OTP SSH implementation allows unauthenticated remote attackers to issue channel open and exec requests before completing authentication. Affecting major enterprise vendors (Cisco, NetApp, SUSE, RabbitMQ), it grants immediate shell access on host systems.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-32433: Pre-Authentication Command Execution in Erlang/OTP SSH ServerVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Pre-Authentication Remote Code Execution in SSH Daemon (CISA KEV)

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-306: Missing Authentication for Critical Function.
Added to CISA KEV on June 9, 2025 (dueDate: 2025-06-30). Critical supply-chain vulnerability impacting network appliances and message brokers integrating Erlang runtimes.

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2025-32433	Official NVD / MITRE record
Vendor Advisory	GHSA-37cp-fgq5-7wc2	Official Erlang/OTP Security Advisory
Associated CWE	CWE-306: Missing Authentication for Critical Function	Processing SSH channel requests without completed authentication
CVSS v3.1 Score	10.0 CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0 Score	9.8 CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Applicable CPEs	cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:*	Embedded SSH servers built with Erlang/OTP
Affected Versions	Erlang/OTP < 25.3.2.16, 26.x < 26.2.5.7, 27.x < 27.2.2	Any system enabling the Erlang SSH subsystem
Fixed Versions	25.3.2.16, 26.2.5.7, 27.2.2 (June 2025)	Official Erlang/OTP security releases

---

2. Exploitation

• CISA KEV: Added on June 9, 2025; remediation deadline June 30, 2025.
• EPSS Score: 0.98594 (Percentile: 99.920% — aggressive automated exploitation).
• Operational Status: Weaponized exploits active in the wild; automated scanners searching for Erlang SSH service banners.
• PoC & Weaponization: Customized SSH clients sending SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST (exec or shell) immediately after key exchange, omitting userauth steps.
• Access Conditions: Pre-authentication; direct network vector via SSH port; trivial attack complexity.

---

3. Threat Intelligence

• Threat Actors: State-sponsored APT groups, botnet operators, and initial access brokers targeting appliance infrastructure.
• Observed Campaigns: Mass scanning across IPv4 ranges searching for SSH-2.0-Erlang/SSH service strings.
• Associated Malware: Modular backdoors, credential dumpers, and persistent SSH reverse tunnels.
• Exploitation Timeline: Disclosed and patched on June 9, 2025, triggering advisories from major downstream vendors (Cisco, NetApp).

---

4. Detection & Forensic Triage

Indicators of Compromise (IOCs)

• Anomalous SSH Frames: SSH sessions requesting execution channels without prior successful authentication exchanges.
• Process Lineage Anomaly: The Erlang BEAM virtual machine (beam.smp) spawning interactive shell binaries (/bin/sh, /bin/bash, cmd.exe).

Sigma Rule

title: Command Execution from Erlang Runtime Process (CVE-2025-32433)
id: e3b2a109-3243-4f12-9876-543210fedcba
status: test
description: Detects system shell spawned by Erlang BEAM virtual machine process
references:
  - https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
author: Hermes Codex Research
date: 2026-09-10
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentProcessName|endswith:
      - '/beam.smp'
      - '/beam'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Administrative maintenance or deployment automation triggered locally
level: critical

YARA Signature

rule Exploit_Erlang_SSH_PreAuth_CVE_2025_32433 {
    meta:
        description = "Detects Erlang SSH pre-authentication exploit frame sequences"
        author = "Hermes Codex Research"
        date = "2026-09-10"
        reference = "CVE-2025-32433"
    strings:
        $erlang_banner = "SSH-2.0-Erlang" ascii
        $msg_channel_open = { 5A 00 00 00 07 73 65 73 73 69 6F 6E } // SSH_MSG_CHANNEL_OPEN session
        $msg_channel_req = { 62 [4] 00 00 00 04 65 78 65 63 } // SSH_MSG_CHANNEL_REQUEST exec
    condition:
        $erlang_banner or ($msg_channel_open and $msg_channel_req)
}

Suricata / Snort Signature

alert tcp $EXTERNAL_NET any -> $SSH_SERVERS any (msg:"HERMES - Erlang/OTP SSH Pre-Authentication Command Execution Attempt (CVE-2025-32433)"; flow:to_server,established; content:"SSH-2.0-"; depth:8; pcre:"/SSH-2\.0-Erlang/s"; classtype:attempted-admin; sid:202532433; rev:1;)

Logs & Forensic Artifacts

• Erlang Application Logs: Review SASL/Logger files for protocol state exceptions in ssh_connection.erl.
• Linux Audit Logs (auditd): Look for execution events (execve) where the parent process is beam.smp.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1021.004 (SSH), T1059.004 (Unix Shell), T1078 (Valid Accounts).

---

5. Remediation & Hardening

1. Apply Security Releases: Upgrade Erlang/OTP to 27.2.2, 26.2.5.7, or 25.3.2.16.
2. Restart Dependent Applications: Restart all services depending on the Erlang runtime (RabbitMQ, telecom controllers, embedded daemons).
3. Deploy Vendor Firmware Updates: Apply patches published by appliance vendors (e.g., Cisco Security Advisory cisco-sa-erlang-otp-ssh).
4. Isolate SSH Management Interfaces: Restrict network exposure of Erlang SSH services to dedicated management subnets via ACLs.
5. Audit Authorized Keys: Verify the integrity of authorized_keys and system administrative accounts.

---

6. Enterprise Impact Scenario

”What happens if this vulnerability is exploited in an enterprise?”

1. Target Identification: The attacker identifies an enterprise appliance or message broker exposing an Erlang-based SSH service on port 22 or management ports.
2. Authentication Protocol Bypass: Establishing the initial TCP connection, the adversary immediately submits an execution channel request without presenting credentials.
3. Unauthenticated Shell Execution: The vulnerable SSH daemon executes the requested commands directly under the beam.smp process context, frequently granting root access.
4. Establishing System Persistence: The adversary appends an unauthorized SSH public key to /root/.ssh/authorized_keys to ensure persistent future access.
5. Network Pivoting and Exfiltration: Operating from the compromised core device, the attacker captures enterprise message streams, compromises internal management VLANs, and facilitates full organizational compromise.