Critical Erlang/OTP SSH Vulnerability Under Active Attack: What You Need to Know

In early 2025, a critical security vulnerability in Erlang/Open Telecom Platform (OTP) SSH came to light, exposing countless systems to potentially devastating attacks. This flaw, officially designated CVE-2025-32433, enables attackers to execute arbitrary code on vulnerable servers without any credentials, creating an immediate and severe threat across industries worldwide. Despite a patch being released in April 2025, attackers began exploiting the vulnerability as early as May, with evidence showing ongoing widespread assaults targeting especially operational technology (OT) networks. This article delves into the details of the vulnerability, the sectors most affected, and what this means for cybersecurity going forward.

the Vulnerability and Exploitation

The vulnerability CVE-2025-32433 is a missing authentication flaw in Erlang/OTP’s native SSH implementation, a crucial component responsible for encrypted communications, file transfers, and command execution within the platform. The issue has a maximum severity score of 10.0 (CVSS), meaning it represents a critical risk. Exploiting this flaw requires only network access to a vulnerable Erlang/OTP SSH server, after which attackers can run arbitrary code remotely.

Despite being patched in April 2025 with updated versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, the vulnerability was actively exploited starting May 2025, with a surge in activity noted by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) when it added the flaw to its Known Exploited Vulnerabilities catalog in June 2025.

Telemetry data from cybersecurity firm Palo Alto Networks’ Unit 42 reveals that roughly 70% of these exploit attempts came from firewalls guarding OT networks. The attacks predominantly target sectors such as healthcare, agriculture, media and entertainment, and high technology across countries including the U.S., Canada, Brazil, India, and Australia. Once attackers gain entry by exploiting CVE-2025-32433, they typically deploy reverse shells to establish unauthorized remote control over victim systems.

Unit 42 researchers emphasize that the attackers employ short, intense bursts of attacks targeting both IT and industrial ports, highlighting a broad and exposed attack surface in industrial environments. Despite the scale and intensity of these attacks, the identities of the perpetrators remain unknown.

What Undercode Say: In-Depth Analysis of the Erlang/OTP SSH Flaw and Its Implications

The exploitation of CVE-2025-32433 serves as a stark reminder of how critical infrastructure and industrial control systems remain vulnerable to sophisticated cyber threats. Erlang/OTP’s SSH implementation is a backbone for secure communication in many high-value systems. A missing authentication flaw of this severity is an uncommon but catastrophic oversight, offering attackers an almost unfettered gateway into networks.

From an operational technology standpoint, the vulnerability’s impact is particularly alarming. OT networks typically manage physical equipment and processes—such as manufacturing lines, power grids, and medical devices—that have traditionally lagged in security upgrades compared to conventional IT systems. The fact that approximately 70% of exploit attempts are linked to OT firewalls reveals that attackers are increasingly focusing on these less-protected environments to cause maximum disruption.

The targeted sectors—healthcare, agriculture, media, and high tech—highlight the diverse range of industries vulnerable to this flaw. Healthcare systems are increasingly interconnected, and an intrusion here could endanger patient safety or disrupt critical services. Agriculture technology often integrates IoT and automation systems for large-scale food production, where sabotage or data breaches could have global repercussions. Media and entertainment sectors depend heavily on uninterrupted digital infrastructure, and attacks here can lead to widespread information manipulation or outages. High tech companies face risks not only from data theft but also potential manipulation of research and development assets.

The attackers’ use of reverse shells post-exploitation is a classic but highly effective technique, allowing them to maintain persistent, remote control and move laterally within networks. This stealthy foothold complicates detection and remediation efforts, underscoring the importance of swift patching and network monitoring.

The patch release timeline also raises concerns. Although the fix was available in April, attacks began in May, suggesting that many organizations delay applying critical updates, often due to operational inertia or fears of disrupting production systems. This gap provides a fertile window for attackers to exploit.

Finally, the intensity and brevity of the attack bursts indicate automated, highly targeted campaigns. Attackers scan for vulnerable hosts and rapidly strike, avoiding prolonged exposure that might trigger defensive responses. This pattern demands adaptive, real-time threat detection methods and proactive defense strategies.

Fact Checker Results ✅❌

✅ The vulnerability CVE-2025-32433 is confirmed critical with a CVSS score of 10.0 and was patched in April 2025.
✅ Active exploitation began in May 2025, with CISA officially acknowledging the threat in June 2025.
✅ Over 70% of detected exploit attempts are linked to OT network firewalls, highlighting industrial environments as prime targets.

Prediction 🔮

Given the current trends, the exploitation of CVE-2025-32433 will likely escalate further, especially as attackers refine their tactics to bypass detection. We expect attackers to broaden their reach beyond the initially targeted sectors, potentially targeting critical infrastructure such as energy and transportation networks. Organizations slow to patch or lacking robust network monitoring will remain vulnerable, facing not only unauthorized access but also potential ransomware or sabotage attacks following initial breaches. This evolving threat landscape will force cybersecurity teams to adopt faster patch management cycles and implement advanced anomaly detection tools specifically tuned for OT environments.