#VU108847 Expected behavior violation in otp - CVE-2025-46712
Vulnerability identifier: #VU108847
Vulnerability risk: Low
CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-440
Exploitation vector: Local network
Exploit availability: No
Vulnerable software:
otp
Other software /
Other software solutions
Vendor: erlang
Description
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to OTP SSH fails to enforce strict kex handshake hardening measures by allowing optional messages to be exchanged. A remote attacker can perform a Man-in-the-Middle attack and inject these messages in a connection during the handshake.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
otp: 22.0, 22.0.1, 22.0.2, 22.0.3, 22.0.4, 22.0.5, 22.0.6, 22.0.7, 22.1, 22.1.1, 22.1.2, 22.1.3, 22.1.4, 22.1.5, 22.1.6, 22.1.7, 22.1.8, 22.1.8.1 - 25.3.2.14, 22.2 - 26.1, 22.2.1 - 26.2.5.2, 22.2.2 - 27.0, 22.2.3 - 27.2.4, 22.2.4 - 27.3.3, 22.2.5, 22.2.6, 22.2.7, 22.2.8, 22.3, 22.3.1, 22.3.2, 22.3.3, 22.3.4, 22.3.4.1, 22.3.4.2, 22.3.4.3, 22.3.4.4, 22.3.4.5, 22.3.4.6, 22.3.4.7, 22.3.4.8, 22.3.4.9, 22.3.4.10, 22.3.4.11, 22.3.4.12, 22.3.4.12.1, 22.3.4.13, 22.3.4.14, 22.3.4.15, 22.3.4.16, 22.3.4.17, 22.3.4.18, 22.3.4.19, 22.3.4.20, 22.3.4.21, 22.3.4.22, 22.3.4.23, 22.3.4.24, 22.3.4.25, 22.3.4.26, 22.3.4.27, 23.0, 23.0.1, 23.0.2, 23.0.3, 23.0.4, 23.1, 23.1.1, 23.1.2, 23.1.3, 23.1.4, 23.1.4.1, 23.1.5, 23.2, 23.2.1, 23.2.2, 23.2.3, 23.2.4, 23.2.5, 23.2.6, 23.2.7, 23.2.7.1, 23.2.7.2, 23.2.7.3, 23.2.7.4, 23.2.7.5, 23.3, 23.3.1, 23.3.2, 23.3.3, 23.3.4, 23.3.4.1, 23.3.4.2, 23.3.4.3, 23.3.4.4, 23.3.4.5, 23.3.4.6, 23.3.4.7, 23.3.4.8, 23.3.4.9, 23.3.4.10, 23.3.4.11, 23.3.4.12, 23.3.4.13, 23.3.4.14, 23.3.4.15, 23.3.4.16, 23.3.4.17, 23.3.4.18, 23.3.4.19, 23.3.4.20, 24.0, 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.1, 24.1.1, 24.1.2, 24.1.3, 24.1.4, 24.1.5, 24.1.6, 24.1.7, 24.2, 24.2.1, 24.2.2, 24.3, 24.3.1, 24.3.2, 24.3.3, 24.3.4, 24.3.4.1, 24.3.4.2, 24.3.4.3, 24.3.4.4, 24.3.4.5, 24.3.4.6, 24.3.4.7, 24.3.4.8, 24.3.4.9, 24.3.4.10, 24.3.4.11, 24.3.4.12, 24.3.4.13, 24.3.4.14, 24.3.4.15, 24.3.4.16, 24.3.4.17, 25.0, 25.0.1, 25.0.2, 25.0.3, 25.0.4, 25.1, 25.1.1, 25.1.2, 25.1.2.1, 25.2, 25.2.1, 25.2.2, 25.2.3, 25.3, 25.3.1, 25.3.2, 25.3.2.1, 25.3.2.2, 25.3.2.3, 25.3.2.4
External links
https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21
https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12
https://github.com/erlang/otp/releases/tag/OTP-27.3.4
https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
