By Rex M. Lee, Security Advisor/Tech Journalist
A critical vulnerability in Erlang/OTP SSH, tracked as CVE-2025-32433 with a CVSS score of 10.0, has been actively exploited since May 2025, targeting operational technology (OT) networks worldwide. Reported by Hacker News, this flaw, patched in April 2025 with releases OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, stems from a missing authentication issue, allowing attackers to execute arbitrary code without credentials. About 70% of attacks hit OT environments, with 85% targeting healthcare, agriculture, media, and tech sectors in the U.S., Canada, Brazil, India, and Australia. Added to CISA’s KEV catalog in June 2025, exploitation involves reverse shells and industrial port attacks, posing risks to critical infrastructure. Urgent patching and enhanced network monitoring are crucial to mitigate this severe threat to national and economic security.


TechTalk Daily