The Reveal Platform
Intel Name: Keys to the kingdom: erlang/otp ssh vulnerability analysis and exploits observed in the wild
Date of Scan: August 12, 2025
Impact: Medium
Summary: The article analyzes CVE-2025-32433, a critical unauthenticated remote code execution (RCE) vulnerability in the SSH daemon of Erlang/OTP, widely used in critical infrastructure and operational technology (OT) networks. The flaw allows attackers to send unauthorized SSH protocol messages to execute commands without authentication. Exploitation activity spiked between May 1–9, 2025, with 70% of detections from firewalls in OT environments. The article includes technical validation, exploit trends, geographic distribution, and affected industries. Patches are available in OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20.
