0x40k<p>Whoa, heads up cybersecurity folks! There's a particularly nasty bug making the rounds: **CVE-2025-32433** in Erlang/OTP SSH. And yes, it scored a perfect CVSS 10.0 🤯.</p><p>We're talking potential **unauthorized remote code execution** here. Basically, an attacker can sneak SSH messages through *before* any authentication even happens. Think about that for a second. If your SSH daemon happens to be running as root... well, that's pretty much game over for the system.</p><p>This isn't just a minor issue; it impacts *anyone* using the Erlang/OTP SSH implementation.</p><p>**The good news?** Patches are available! You'll want to update to one of these versions ASAP:<br>* OTP-27.3.3<br>* OTP-26.2.5.11<br>* OTP-25.3.2.20</p><p>Speaking as a pentester, gotta say, that's a clever (and worrying!) vulnerability path 😉. Another thing to keep in mind: your typical automated vulnerability scanners might completely miss this one due to the pre-auth nature.</p><p>So, what's your take? Have any of you run into this yet or started testing for it? Curious to know what tools you're finding effective for detection or exploitation testing! Let's discuss 👇</p><p><a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Erlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Erlang</span></a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OTP</span></a> <a href="https://infosec.exchange/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SSH</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RCE</span></a> <a href="https://infosec.exchange/tags/PatchNow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PatchNow</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a></p>