Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Summary: Unit 42 observed active exploitation of CVE-2025-32433, an unauthenticated remote code execution flaw in the Erlang/OTP SSH daemon rated CVSS 10.0, with the earliest attempt on May 1, 2025 and a surge in activity from May 1-9. Of 3,376 signature triggers globally, 2,363 (about 70%) originated from firewalls protecting OT networks, and OT networks saw 160% more attempts per device than non-OT networks.
Why it matters: Attackers sent SSH protocol messages with codes of 80 or higher to ports that should only accept them after authentication, and the education sector alone accounted for 2,460 triggers (72.7% of the total) - a reminder that the exposed Erlang/OTP services Cortex Xpanse found on industrial ports like 2222 sit on networks many organizations never classified as OT.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2025-32433
- Related
- CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 09, 2025Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026