Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 09/06/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| cloud native broadband network gateway | < 2025.03.1 | 2025.03.1 |
| confd basic | ≥ 8.0.18, < 8.1.16.2≥ 8.2, < 8.2.11.1≥ 8.3, < 8.3.8.1≥ 8.4, < 8.4.4.1< 7.7.19.1 | 8.1.16.28.2.11.18.3.8.18.4.4.17.7.19.1 |
| enterprise nfv infrastructure software | < 4.18 | 4.18 |
| network services orchestrator | ≥ 5.8, < 6.1.16.2≥ 6.2, < 6.2.11.1≥ 6.3, < 6.3.8.1≥ 6.4, < 6.4.1.1≥ 6.4.2, < 6.4.4.1< 5.7.19.1 | 6.1.16.26.2.11.16.3.8.16.4.1.16.4.4.15.7.19.1 |
| optical site manager | < 25.2.1 | 25.2.1 |
| smart phy | < 25.2 | 25.2 |
| ultra cloud core | < 2025.03.1 | 2025.03.1 |
| ultra packet core | < 2025.03 | 2025.03 |
| erlang/otp | ≥ 26.0, < 26.2.5.11≥ 27.0, < 27.3.3< 25.3.2.20 | 26.2.5.1127.3.325.3.2.20 |
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free