A vulnerability (CVE-2025-32433) has been identified in the ssh library included in the Erlang/OTP toolset, allowing remote code execution on an SSH server created with the vulnerable library without authentication. The issue has been assigned a critical severity level (10 out of 10).
One security researcher has already prepared a working exploit to execute code on vulnerable SSH servers. Notably, according to the researcher, the code was created using AI assistants GPT-4, Cursor, and Sonnet based on the analysis of changes with the vulnerability fix, including a test to verify the issue's resolution.
The library from the Erlang/OTP project provides ready-made implementations of a client and server SSH and SFTP that support the SSH 2.0 protocol. You can identify problematic SSH servers by the header output "SSH-2.0-Erlang/version". Erlang/OTP-based SSH servers are used in specialized systems, such as IoT devices and edge computing devices, as well as a debugging tool—Erlang makes it easy to enable an SSH server for remote debugging of applications (it is presumed that such debugging capabilities may have been left enabled in many projects written in Erlang). The issue also manifests in the Elixir toolkit (implemented on top of Erlang) and in the Phoenix framework built on it, although the SSH server in Phoenix does not accept requests from external networks by default.
The vulnerability is caused by a parsing error in the code, which allowed SSH_MSG_CHANNEL_REQUEST messages that permit the execution of the "exec" command to be processed before authentication. Example code from the exploit: command = 'file:write_file("/lab.txt", <>').' return ( b"\x62" # SSH_MSG_CHANNEL_REQUEST + struct.pack(">I", channel_id) + string_payload("exec") + b"\x01" # want_reply = true + string_payload(command) )
The vulnerability has been fixed in Erlang/OTP releases 27.3.3, 26.2.5.11, and 25.3.2.20. You can track the vulnerability fix in the distributions on the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Arch, FreeBSD.
Source: opennet.ru
