Overview

Multiple Cisco products are affected by a critical vulnerability. The vulnerability could allow a remote attacker to execute code on the affected device.

Description

ConfD, Network Services Orchestrator (NSO), Smart PHY, ASR 5000 Series Software (StarOS), Ultra Packet Core1, iNode Manager, Ultra Cloud Core, Enterprise NFV Infrastructure Software (NFVIS), and Small Business RV Series Routers are affected by critical vulnerabilities tracked as CVE-2025-32433, with a CVSS base score of 10. The vulnerability results from a flaw in the handling of SSH messages during the authentication phase. Successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to perform remote code execution (RCE) on an affected device.

Impact

Successful exploitation of these vulnerabilities may allow the attacker to take control of the affected system.

Solution

Cisco has released patches for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy