PT-2025-20412 · Ericsson+4 · Erlang/Otp+4

Lambdafu + 1 · Published 2025-05-08 · Updated 2025-10-30 · CVE-2025-46712

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions prior to OTP-27.3.4 Erlang/OTP versions prior to OTP-26.2.5.12 Erlang/OTP versions prior to OTP-25.3.2.21

Description The issue concerns Erlang/OTP SSH failing to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake.

Recommendations For versions prior to OTP-27.3.4, update to OTP-27.3.4 or later. For versions prior to OTP-26.2.5.12, update to OTP-26.2.5.12 or later. For versions prior to OTP-25.3.2.21, update to OTP-25.3.2.21 or later.

Exploit

Fix

Weakness Enumeration

CWE-440

Related Identifiers

AZL-61744

AZL-61748

BDU:2025-13872

CVE-2025-46712

GHSA-934X-XQ38-HHQF

OESA-2025-1552

OESA-2025-1553

USN-7656-1

Affected Products

Debian

Erlang/Otp

Linuxmint

Red Os

Ubuntu

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46712.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46712 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46712 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46712 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46712 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1552 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46712 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13872 · Security Note
• https://ubuntu.com/security/CVE-2025-4748 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1553 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61748 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46712 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61744 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7656-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46712 · Vendor Advisory