Erlang/OTP SSH Exploits Spiked After April Patch

Exploitation attempts against a severe vulnerability in a runtime system widely deployed in operational technology environments spiked globally in the days after open-source maintainers of the Erlang/OTP project published a patch.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

Researchers from Palo Alto Network’s Unit 42 said Monday they saw a “significant increase in exploitation activity” targeting the vulnerability starting roughly two weeks after it became public in mid-April. Telemetry collected from May 1 through May 9 showed that 70% of detected exploit activity originated in firewalls protection OT networks, Unit 42 said.

Tracked as CVE-2025-32433 with a maximum CVSS score of 10, the vulnerability lets attackers take full control of systems through an flaw in how the embedded Erlang secure shell processes messages. Its discoverers, a group of academics from the University Bochum, found they could start sending commands to the embedded secure shell before the local server authenticated the connection request.

“If your SSH daemon is running as root, the attacker has full access to your device,” the academics warned in an April 16 disclosure. The Erlang project released patches, warning that all users of the Erlang/OTP SSH server were impacted. Security researchers published a proof of concept exploit on April 17. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw on June 9 to its catalog of known exploited vulnerabilities.

Erlang/OTP combines the Erlang programming language with the Open Telecom Platform, a set of libraries and tools for building large-scale, fault-tolerant, distributed systems. Originally developed for telecommunications, it’s now widely used in industrial, financial and other sectors that need real time, concurrent processing.

Unit 42 said the bulk of the exploitation attempts came from the healthcare, agriculture, media and high technology sectors. An outsized number of exploitations affected the education sector, a fact that “challenges the traditional view that OT risk is confined to industrial control systems or manufacturing.”

Despite their high reliance on OT devices, utilities, mining, aerospace and defense sectors “showed no direct OT triggers for this specific threat.”

One technique used by attackers was out-of-band application security testing, which they executed by deploying payloads directed to conduct domain name service lookups of randomly generated subdomains under dns.outbound.watchtowr.

Internet scans showed that “Erlang/OTP services are widely exposed and vulnerable on industrial networks,” and often expose TCP port 2222, Unit 42 said. That’s significant because the same port is also used to communicate application-specific, low-latency data known as implicit messages through the industrial network protocol EtherNet/IP. As a result, attackers scanning for vulnerable Erlang services could pivot into OT environments, “especially where network segmentation is weak.”

“By the time breaches are detected, attackers were often already inside the network through other means and simply moving laterally toward OT systems,” said April Lenhard, principal product manager at Qualys. “This means they are exploiting the growing convergence of IT and OT systems to penetrate critical infrastructure across industries.”