Cisco Issues Critical Advisory on Erlang/OTP SSH Server RCE Vulnerability (CVE-2025-32433)
Cisco Systems has released a critical security advisory confirming that multiple products across its portfolio are affected by a remote code execution (RCE) vulnerability in the Erlang/OTP SSH server, identified as CVE-2025-32433.
The vulnerability, rated with the maximum CVSS v3.1 score of 10.0, allows unauthenticated attackers to execute arbitrary code on vulnerable systems. It stems from improper handling of SSH messages during the authentication process.
A wide range of critical infrastructure is impacted, including network orchestration tools and enterprise routing platforms. Proof-of-concept exploit code is already circulating within security communities, increasing the urgency of the threat.
Details of the Erlang SSH Server RCE Vulnerability
The flaw lies in the Erlang/OTP implementation of the SSH protocol (RFC 4252), specifically in how channel request messages are processed prior to authentication. Attackers can send specially crafted SSH packets to bypass authentication, gaining direct access to the Erlang runtime environment.
Once exploited, attackers can execute operating system commands under the privileges of the SSH service account—typically running as root or an administrative user.
Cisco’s advisory emphasizes that the exploit requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), making publicly exposed systems particularly vulnerable. The concurrent nature of the Erlang/OTP platform further amplifies the risk, as a single compromised SSH session could trigger the spread of malicious processes across distributed nodes in clustered environments.
Affected Cisco Products and Risk Overview
| Risk Factors | Details |
|---|---|
| Impacted Products | Network Services Orchestrator, Ultra Cloud Core, Intelligent Node Manager, Catalyst Center, Smart PHY, ConfD, and ConfD Basic |
| Impact | Remote Code Execution (RCE) |
| Exploit Conditions | – Vulnerable Erlang/OTP version running – SSH daemon enabled and accessible – No authentication or user interaction required |
| CVSS v3.1 Score | 10.0 (Critical) |
Cisco Investigates Widespread Impact of Erlang/OTP SSH Server Vulnerability
Cisco has identified 18 product families currently under active investigation, with confirmed impacts on several key solutions:
- Network Services Orchestrator (NSO): Critical for service provider orchestration (CVE ID: CSCwo83796)
- Ultra Cloud Core – Subscriber Microservices Infrastructure: Core component of 5G network infrastructure (CVE ID: CSCwo83747)
- Intelligent Node Manager: Centralized management application for servers and virtual machines
- Wide Area Application Services (WAAS): Infrastructure for application acceleration and optimization (under investigation)
- Catalyst Center (formerly DNA Center): Enterprise network management platform (under investigation)
Notably, while vulnerabilities have been identified in ConfD and ConfD Basic network automation tools (CVE ID: CSCwo83759), configuration safeguards currently prevent remote code execution (RCE) risks.
Cisco has also confirmed that the following products are not affected:
- Cisco IOS XE Software
- Secure Firewall Management Center
- Identity Services Engine (ISE)
Remediation Timeline and Mitigation Efforts
Cisco plans to release phased patches beginning in May 2025, prioritizing critical products like NSO and ConfD. However, many fixes are still under development.
In the absence of viable workarounds, Cisco recommends organizations immediately implement strict network controls, including:
- Segregating management interfaces from untrusted networks
- Enforcing firewall policies to restrict SSH access to trusted IP ranges
- Monitoring for anomalous authentication patterns indicative of exploitation attempts
Given Erlang/OTP’s integral role in telecommunications, cloud platforms, and enterprise IT systems, this vulnerability introduces systemic risk across distributed environments.
Security Recommendations
Organizations should act swiftly to:
- Audit all deployments utilizing Erlang/OTP versions 25.0 through 26.1
- Prioritize patching for internet-exposed SSH services
- Deploy runtime protections to detect and respond to exploit activity
Cisco’s Product Security Incident Response Team (PSIRT) confirms ongoing monitoring for in-the-wild exploitation, although no active malicious campaigns have been observed as of April 24, 2025.
Broader Implications
This marks the third major SSH-related vulnerability to impact enterprise systems in 2025, highlighting an urgent need for more rigorous protocol-level security audits across distributed infrastructure.
While awaiting official patches, organizations must focus on containment strategies and proactive threat-hunting to detect early signs of compromise.
