Ransomware.live 👀

Actively exploited in the wild (CISA KEV / Shadowserver / KEVIntel).

CISA KEV

Exploited

CVSS 3.1 Score

10.0

CRITICAL

EPSS Score

98.79%

EPSS Percentile

99.9%

as of 2026-10-05

NVD Status

Analyzed

Published 2025-04-16

Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Affected Vendors / Products

Erlang	Erlang\/Otp
Cisco	Confd Basic
Cisco	Network Services Orchestrator
Cisco	Cloud Native Broadband Network Gateway
Cisco	Inode Manager
Cisco	Smart Phy
Cisco	Ultra Packet Core
Cisco	Ultra Services Platform
Cisco	Staros
Cisco	Optical Site Manager
Cisco	Ncs 2000 Shelf Virtualization Orchestrator Firmware
Cisco	Enterprise Nfv Infrastructure Software
Cisco	Ultra Cloud Core
Cisco	Rv160W Firmware
Cisco	Rv260 Firmware
Cisco	Rv160 Firmware
Cisco	Rv260P Firmware
Cisco	Rv260W Firmware
Cisco	Rv340 Firmware
Cisco	Rv340W Firmware
Cisco	Rv345 Firmware
Cisco	Rv345P Firmware
Debian	Debian Linux

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness (CWE)

CWE-306

Last Modified

2026-06-17

CVSS 3.1 Vector Breakdown

CISA Vulnrichment (SSVC)

Exploitation: active Automatable: yes Technical Impact: total

Source: vulnerability-lookup.org

Exploitation Intelligence (2 sources)

Source	Exploited	Ransomware Use	Notes
kevintel	Yes	—	KEVIntel entry: Erlang/OTP SSH Vulnerable to Pre-Authentication RCE \| Affected: erlang / otp \| CVSS: 10.0 (CRITICAL) \| EPSS: 0.97673 \| Used in malware: unknown \| Not yet in CISA KEV: False
cisa-kev	Yes	—	KEV entry: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability \| Affected: Erlang / Erlang/OTP \| Description: Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE. \| Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. \| Due date: 2025-06-30 \| Known ransomware campaign use (KEV): Unknown \| Notes (KEV): This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy ; https://nvd.nist.gov/vuln/detail/CVE-2025-32433

Correlated via CISA KEV, Shadowserver & KEVIntel.com. Source: vulnerability-lookup.org

Vendor Exploitability (VEX) (2 statements)

Vendor Source	Status	Statement
Red Hat CSAF VEX	known not affected (1)	Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
SUSE CSAF VEX	known not affected (20) recommended (98)	—