Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco cloud native broadband network gatewaybefore 2025.03.1
• cisco confd basic8.3 and later · before 8.3.8.1
• cisco confd basic8.4 and later · before 8.4.4.1
• cisco confd basicbefore 7.7.19.1
• cisco confd basic8.0.18 and later · before 8.1.16.2
• cisco confd basic8.2 and later · before 8.2.11.1
• cisco enterprise nfv infrastructure softwarebefore 4.18
• cisco inode managerall versions
• cisco ncs 2000 shelf virtualization orchestrator firmwarebefore 25.1.1
• cisco network services orchestrator6.2 and later · before 6.2.11.1
• cisco network services orchestratorbefore 5.7.19.1
• cisco network services orchestrator5.8 and later · before 6.1.16.2
• cisco network services orchestrator6.3 and later · before 6.3.8.1
• cisco network services orchestrator6.4 and later · before 6.4.1.1
• cisco network services orchestrator6.4.2 and later · before 6.4.4.1
• cisco optical site managerbefore 25.2.1
• cisco rv160 firmwareall versions
• cisco rv160w firmwareall versions
• cisco rv260 firmwareall versions
• cisco rv260p firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (GitHub_M). Independent of NVD's CPE analysis and usually ahead of it.

• erlang otp

  • >= OTP-27.0-rc1, < OTP-27.3.3, >= OTP-26.0-rc1, < OTP-26.2.5.11, < OTP-25.3.2.20affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-37026In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-cert
  39Monitor
• CVE-2016-10253An issue was discovered in Erlang/OTP 18.x.
  39Monitor
• CVE-2026-55953TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
  36Monitor
• CVE-2026-49759Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
  35Monitor
• CVE-2026-59251Denial of service via exponential certificate policy tree growth in path validation
  34Monitor
• CVE-2026-58227TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.