The Critical Erlang OTP Flaw Being Exploited in the Wild: Cyber Security News

Start with, I wanted to do a little bit of a technical deep dive into one of the most interesting and critical vulnerabilities that's being exploited in the wild. That is the Erlang OTP SSH server. The CVE scored a perfect 10. That's not necessarily a great thing. That is CVE 2025-32433. It is a pre-authentication remote code execution bug. This is basically as bad as it gets. So, if you're not familiar with Erlang or Erlang OTP, there is a reason why this is so critical. So, what is Erlang? Well, Erlang is actually a programming language and it was created by Ericsson back in the 1980s. And I know that this may seem archaic, but it's widely used by so many things today. It was designed for telecom systems that needed to run non-stop. Think of millions of phone calls being made all at once. Not only did this need to have zero downtime, it needed to allow for millions of connections to run concurrently. And famously, Erlang was fault tolerant. This meant that if a certain part or multiple parts of the system failed, it would still work. So, that was in the 1980s, right? But what about today? Well, all of those traits that made it great back then still make it great today. And the scale has gotten bigger, which means it's even more relevant. Services like WhatsApp use Erlang, CouchDB, and lots of other back-end systems that need this fault tolerance and also massive concurrency. So, what about the fault itself? Well, this was an Erlang OTP and that stands for the Erlang Open Telecom Platform. And this is essentially used for being able to build these fault tolerant systems. Now, like a lot of these frameworks or tools, it packaged lots of things together to be able to make that possible. One of those things that it packaged together was SSH or secure shell. Now, like SSH that you're used to in other applications, this allowed Erlang applications to act as remote servers. And this SSH protocol allowed you to connect into this server and be able to run commands, right? So, pretty catastrophic when I tell you that with no authentication, you could actually bypass all security and run arbitrary commands on Erlang systems running Erlang OTP. This is pretty wild. So, just to recap, Erlang is a language built for telecommunications that allowed for massive concurrency and fault-tolerant applications. What made it great in the 1980s makes it great today. Lots of applications use it and their Erlang OTP package, Open Telecom Protocol, which is what you would use to build something in Erlang, has a massive critical vulnerability within it relating to its SSH protocol. We got there. So, how does this actually happen? Well, SSH is famously known for being able to run commands on a server, but you have to be authenticated in and that authentication is typically pretty good. But, due to a flaw in message handling of this particular protocol, the SSH daemon could be tricked into running arbitrary commands on an attacker's behalf. No authentication, no password, no nothing. If you built a specifically crafted package, you could get it to run commands on a server. I want to remind you what Erlang is used for. So, this is pretty scary. To make matters worse, if this is running as root on your server, which often it is, then basically game over, full control. That's what gives us this full 10 vulnerability score, which I got to say, you don't see a lot of straight-out 10s. 9.9s maybe, 10s, very rare. This vulnerability was actually reported in April. So, why on Earth am I talking about it now as obviously we're in August. Well, the reason why I'm talking about this is that there's been a lot of reporting about this being exploited in the wild. It's one thing to have critical vulnerabilities. It's a whole another thing when you actually start seeing that translate into real-life attacks. And in this case, we're definitely seeing that. And what's even more scary is where we're seeing this being exploited, right? We're seeing it being exploited in telecom applications, firewalls, IoT gateways, really critical infrastructure. This can have massive implications, and to be honest, this is an APT's dream for nation states to be able to get into some critical infrastructure. Unit 42 from Palo Alto Networks has been doing some great research in discovering and identifying attacks happening in the wild. What they've said is around about 70% of the attacks that they've observed are for firewalls. And this makes sense because if you can control a firewall, then you can essentially control access into critical infrastructure or critical networks. That's exactly what we're seeing here. Not only could you spy on these networks and infiltrate them potentially, but you could also block traffic and cause disruptions, right? And we go back to what I just said about this being a nation state's dream. This is the exact modus operandi of an APT, really disrupting services, spying on information, and getting in more access. So, what's actually affected from this? Well, it's not just Erlang OTP, it's a lot of systems that rely on it. Anything that relies on Erlang 23 up to 27.3.3, you absolutely need to patch, and I would make sure that all of your systems are up to date. Also, various Cisco and other embedded systems are affected as well. So, you want to make sure that you get a complete list of everything that's relying on this system. Beyond just updating, then you also want to other systems. For example, make sure you limit your SSH connections to known IPs. In fact, turn off the SSH daemon if it's not needed entirely. Make sure you set very strict firewall settings, and of course, monitor your systems for any unknown breaches. Well, that's what we had for our cybersecurity news deep dive this week.