CVE-2025-32433 - 漏洞详情

CVE-2025-32433 (CNNVD-202504-2737)

CRITICAL

中文标题:

Erlang/OTP 访问控制错误漏洞

英文标题:

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

CVSS分数: 10.0

发布时间: 2025-04-16 21:34:37

漏洞类型: 授权问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 27.3.3之前版本存在访问控制错误漏洞，该漏洞源于SSH协议消息处理缺陷，可能导致远程代码执行。

英文描述:

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CWE类型:

CWE-306

受影响产品

厂商	产品	版本	版本范围	平台	CPE
erlang	otp	>= OTP-27.0-rc1, < OTP-27.3.3	-	-	`cpe:2.3:a:erlang:otp:>=_otp-27.0-rc1,_<_otp-27.3.3:::::::*`
erlang	otp	>= OTP-26.0-rc1, < OTP-26.2.5.11	-	-	`cpe:2.3:a:erlang:otp:>=_otp-26.0-rc1,_<_otp-26.2.5.11:::::::*`
erlang	otp	< OTP-25.3.2.20	-	-	`cpe:2.3:a:erlang:otp:<_otp-25.3.2.20:::::::*`
erlang	erlang\/otp	*	-	-	`cpe:2.3:a:erlang:erlang\/otp::::::::`
cisco	confd_basic	*	-	-	`cpe:2.3:a:cisco:confd_basic::::::::`
cisco	network_services_orchestrator	*	-	-	`cpe:2.3:a:cisco:network_services_orchestrator::::::::`
cisco	cloud_native_broadband_network_gateway	*	-	-	`cpe:2.3:a:cisco:cloud_native_broadband_network_gateway::::::::`
cisco	inode_manager	-	-	-	`cpe:2.3:a:cisco:inode_manager:-:::::::*`
cisco	smart_phy	*	-	-	`cpe:2.3:a:cisco:smart_phy::::::::`
cisco	ultra_packet_core	*	-	-	`cpe:2.3:a:cisco:ultra_packet_core::::::::`
cisco	ultra_services_platform	-	-	-	`cpe:2.3:a:cisco:ultra_services_platform:-:::::::*`
cisco	staros	*	-	-	`cpe:2.3:o:cisco:staros::::::::`
cisco	optical_site_manager	*	-	-	`cpe:2.3:a:cisco:optical_site_manager::::::::`
cisco	ncs_2000_shelf_virtualization_orchestrator_firmware	*	-	-	`cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware::::::::`
cisco	enterprise_nfv_infrastructure_software	*	-	-	`cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software::::::::`
cisco	ultra_cloud_core	*	-	-	`cpe:2.3:a:cisco:ultra_cloud_core::::::::`
cisco	rv160w_firmware	-	-	-	`cpe:2.3:o:cisco:rv160w_firmware:-:::::::*`
cisco	rv260_firmware	-	-	-	`cpe:2.3:o:cisco:rv260_firmware:-:::::::*`
cisco	rv160_firmware	-	-	-	`cpe:2.3:o:cisco:rv160_firmware:-:::::::*`
cisco	rv260p_firmware	-	-	-	`cpe:2.3:o:cisco:rv260p_firmware:-:::::::*`
cisco	rv260w_firmware	-	-	-	`cpe:2.3:o:cisco:rv260w_firmware:-:::::::*`
cisco	rv340_firmware	-	-	-	`cpe:2.3:o:cisco:rv340_firmware:-:::::::*`
cisco	rv340w_firmware	-	-	-	`cpe:2.3:o:cisco:rv340w_firmware:-:::::::*`
cisco	rv345_firmware	-	-	-	`cpe:2.3:o:cisco:rv345_firmware:-:::::::*`
cisco	rv345p_firmware	-	-	-	`cpe:2.3:o:cisco:rv345p_firmware:-:::::::*`
debian	debian_linux	11.0	-	-	`cpe:2.3:o:debian:debian_linux:11.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 x_refsource_CONFIRM
cve.org

访问

https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 x_refsource_MISC
cve.org

访问

https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f x_refsource_MISC
cve.org

访问

https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891 x_refsource_MISC
cve.org

访问