CVE-2025-32433

criticalpriority · act · 90KEV · exploitedEPSS 0.988 · 100 %ileexploit · weaponizedDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 42 exploits · weaponized

Likely / severe?

98.8% (100th) EPSS

CVSS 10 · critical

Is it mine?

137 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-06-09remediate by 2025-06-30

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-21

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familysiemens_psirt
See Section Additional Information.
FixedSCALANCE XCH328 (6GK5328-4TS01-2EC2)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM324 (6GK5324-8TS01-2AC2)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM328 (6GK5328-4TS01-2AC2)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3)siemens_psirt
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedGalaxy VLcisa_csaf_ot
Version 18.10.0 of Galaxy VL includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.
FixedGalaxy VScisa_csaf_ot
Version 6.123.0 of Galaxy VS includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.
FixedGalaxy VXLcisa_csaf_ot
Version 15.29.0 of Galaxy VXL includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.
FixedRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familycisa_csaf_ot
See Section Additional Information.
FixedSCALANCE XCH328 (6GK5328-4TS01-2EC2)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM324 (6GK5324-8TS01-2AC2)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM328 (6GK5328-4TS01-2AC2)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
FixedSCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3)cisa_csaf_ot
Update to V3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997626/
MitigationGalaxy VLcisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: 1. Log on to the NMC4 via the Web Interface. Once logged into the system, navigate to the Console settings page from the menu bar by selecting Configuration -> Network -> Console -> Access 2. From the Console setting screen, uncheck the enable SSH/SFTP/SCP check box -> Click Apply As an alternative, setup network segmentation and implement a firewall to block all unauthorized access to SSH port 22/TCP. If assistance is needed applying the above mitigation, please contact our technical support team: https://www.se.com/ww/en/work/support/ To learn more, we recommend reviewing the Network Management Card 4 Security Handbook for specific actions available here to secure your devices further: https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/ To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/
MitigationGalaxy VScisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: 1. Log on to the NMC4 via the Web Interface. Once logged into the system, navigate to the Console settings page from the menu bar by selecting Configuration -> Network -> Console -> Access 2. From the Console setting screen, uncheck the enable SSH/SFTP/SCP check box -> Click Apply As an alternative, setup network segmentation and implement a firewall to block all unauthorized access to SSH port 22/TCP. If assistance is needed applying the above mitigation, please contact our technical support team: https://www.se.com/ww/en/work/support/ To learn more, we recommend reviewing the Network Management Card 4 Security Handbook for specific actions available here to secure your devices further: https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/ To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/
MitigationGalaxy VXLcisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: 1. Log on to the NMC4 via the Web Interface. Once logged into the system, navigate to the Console settings page from the menu bar by selecting Configuration -> Network -> Console -> Access 2. From the Console setting screen, uncheck the enable SSH/SFTP/SCP check box -> Click Apply As an alternative, setup network segmentation and implement a firewall to block all unauthorized access to SSH port 22/TCP. If assistance is needed applying the above mitigation, please contact our technical support team: https://www.se.com/ww/en/work/support/ To learn more, we recommend reviewing the Network Management Card 4 Security Handbook for specific actions available here to secure your devices further: https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/ To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306USCWE-306USCWE-306USCWE-306US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (42)

Public proof-of-concept and weaponised exploit code.

exploit/linux/ssh/ssh_erlangotp_rceErlang OTP Pre-Auth RCE Scanner and Exploitweaponized · metasploit
0x7556/CVE-2025-32433CVE-2025-32433 Erlang/OTP SSH RCE Exploit SSH远程代码执行漏洞EXPPoC · poc_in_github
0xBlackash/CVE-2025-32433CVE-2025-32433PoC · poc_in_github
0xPThree/cve-2025-324330xPThree/cve-2025-32433PoC · poc_in_github
AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433PoC · poc_in_github
Batman529/PoC-CVE-2025-32433These is a PoC for the CVE-2025-32433 vulnerability, do NOT test on systems that you dont own!!!PoC · poc_in_github

affected products (137)

Products and version ranges known to be affected.

Cisco Network Services Orchestratorall versionscert_bundDEcpe:/a:cisco:network_services_orchestrator:-
Cisco Router ASR 5000all versionscert_bundDEcpe:/h:cisco:router:asr_5000
Cisco Small Business RV160all versionscert_bundDEcpe:/h:cisco:small_business:rv160
Cisco Small Business RV160Wall versionscert_bundDEcpe:/h:cisco:small_business:rv160w
Cisco Small Business RV260all versionscert_bundDEcpe:/h:cisco:small_business:rv260
Cisco Small Business RV260Pall versionscert_bundDEcpe:/h:cisco:small_business:rv260p
Cisco Small Business RV260Wall versionscert_bundDEcpe:/h:cisco:small_business:rv260w
Cisco Small Business RV340all versionscert_bundDEcpe:/h:cisco:small_business:rv340
Cisco Small Business RV340Wall versionscert_bundDEcpe:/h:cisco:small_business:rv340w
Cisco Small Business RV345all versionscert_bundDEcpe:/h:cisco:small_business:rv345
Cisco Small Business RV345Pall versionscert_bundDEcpe:/h:cisco:small_business:rv345p
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell NetWorker <19.11.0.5all versionscert_bundDE
Dell NetWorker <19.13all versionscert_bundDE
Dell NetWorker vProxy <19.12.0.3all versionscert_bundDE
Open Source Erlang/OTP <OTP-25.3.2.20all versionscert_bundDE
Open Source Erlang/OTP <OTP-26.2.5.11all versionscert_bundDE
Open Source Erlang/OTP <OTP-27.3.3all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-

showing 20 of 137

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2025-0137Kwetsbaarheid verholpen in Erlang/OTP SSH-serverNL2025-04-18csaf · ncsc_nlNL
De ontwikkelaars van Erlang/OTP hebben een kwetsbaarheid verholpen in Erlang OTP.
SSA-089022SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.32026-01-28csaf · siemens_psirtDE
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
WID-SEC-W-2025-0838Erlang/OTP SSH: Schwachstelle ermöglicht CodeausführungDeutsch2025-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Erlang/OTP ausnutzen, um beliebigen Programmcode auszuführen.
ICSA-25-140-07Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)2025-05-13icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability disclosed on the Erlang/OTP's SSH Server component used Schneider Electric Galaxy VS, VL, and VXL.Many vendors, including Schneider Electric, embed the Erlang/OTP's SSH Server in their offers.The Galaxy VS, Galaxy VL, Galaxy VXL products are 3-phase UPS for data centers and other business critical applications.Failure to apply the mitigation provided below may risk unauthenticated remote code execution (RCE), which could impact the monitoring capabilities of the UPS and potential UPS operation.
ICSA-26-043-06Siemens SINEC OS2026-01-28icsa · cisa_csaf_otUS
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl siemens_psirt cisa_csaf_ot NVD CVE.org MITRE

published 2025-04-16modified 2026-06-17

references (26)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan