Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Evidence dossier
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
84.9–99.9Priority evidence range
gen-56ccdaf9Normalized restatement
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
- State
- PUBLISHED
- Published
- Apr 16, 2025
- Updated
- Feb 26, 2026
- Evidence coverage
- 85%
2026-07-18 · v2026.06.15 · percentile 99.9%
Distinct CVSS assessments remain side by side; none are averaged.
Source comparison
Who said what
GitHub_Moriginal assertion
container
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Jul 19, 2026Original evidence ↗
CISA KEVoriginal assertion
observed_exploitation
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Jul 19, 2026Original evidence ↗
FIRST EPSSoriginal assertion
model_probability
Probability 0.985940000000; percentile 0.999180000000
Jul 19, 2026Original evidence ↗
Applicability
Cited product scope
erlangotp
[{"status": "affected", "version": ">= OTP-27.0-rc1, < OTP-27.3.3"}, {"status": "affected", "version": ">= OTP-26.0-rc1, < OTP-26.2.5.11"}, {"status": "affected", "version": "< OTP-25.3.2.20"}]unknownUnknown vendorUnknown product
cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:*; end excluding 2025.03.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*; end excluding 7.7.19.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*; start including 8.0.18; end excluding 8.1.16.2supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*; start including 8.2; end excluding 8.2.11.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*; start including 8.3; end excluding 8.3.8.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*; start including 8.4; end excluding 8.4.4.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*; end excluding 4.18supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; end excluding 5.7.19.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; start including 5.8; end excluding 6.1.16.2supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; start including 6.2; end excluding 6.2.11.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; start including 6.3; end excluding 6.3.8.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; start including 6.4; end excluding 6.4.1.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*; start including 6.4.2; end excluding 6.4.4.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:*; end excluding 25.2.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*; end excluding 25.2supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:*; end excluding 2025.03.1supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:*; end excluding 2025.03supportedUnknown vendorUnknown product
cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*; end excluding 25.3.2.20supportedUnknown vendorUnknown product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*; start including 26.0; end excluding 26.2.5.11supportedUnknown vendorUnknown product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*; start including 27.0; end excluding 27.3.3supportedUnknown vendorUnknown product
cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*constrainedUnknown vendorUnknown product
cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:*; end excluding 25.1.1supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*supportedUnknown vendorUnknown product
cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*; end excluding 2025.03supportedUnknown vendorUnknown product
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*supportedAssessments
CVSS by origin
security-advisories@github.comCVSS 3.1 · role Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HGitHub_MCVSS 3.1 · role unknown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLimitations and unknowns
- KEV membership is authoritative for the catalog, not proof of exposure in any environment.
- EPSS is a dated model probability and not an individual-environment prediction.
- Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
- NVD-carried upstream facts remain derivative and are not independent corroboration.
- Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
- NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
- Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
- Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.