Erlang/OTP SSH Flaw CVE-2025-32433 Exposed to Widespread RCE Exploitation

Erlang/OTP disclosed CVE-2025-32433 in its SSH implementation as an unauthenticated remote code execution vulnerability, tracked in GitHub advisory GHSA-37cp-fgq5-7wc2. Public descriptions characterize the issue as a pre-authentication flaw tied to improper handling of SSH protocol messages, including malformed SSH_MSG_CHANNEL_REQUEST packets, allowing attackers to execute code on exposed Erlang-based SSH servers without valid credentials. Several repositories also describe the weakness as related to missing authentication for a critical function (CWE-306).

After disclosure, GitHub saw a rapid spread of public exploit material, including proof-of-concept code, remote shell implementations, offensive modules, lab-focused exploit scripts, and later detection tooling. Repositories from multiple authors published exploit variants in Go and other formats, along with testing tools for identifying vulnerable systems, indicating that exploitation knowledge quickly became broadly accessible to both defenders and attackers. The volume and persistence of these repositories suggest that organizations running Erlang/OTP SSH services faced elevated risk of opportunistic scanning and weaponized exploitation soon after the advisory became public.