« Volver al listado

CVE-2025-46712

Estado: AplazadaBaja (3.7)—

Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Erlang — OTPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-46712",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46712",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-08T20:02:52.990837Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "erlang",
          "product": "otp",
          "versions": [
            {
              "status": "affected",
              "version": ">= OTP 27.0, < OTP 27.3.4"
            },
            {
              "status": "affected",
              "version": ">= OTP 26.2.1, < OTP 26.2.5.12"
            },
            {
              "status": "affected",
              "version": "< OTP 25.3.2.21"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-08T20:15:30.807",
  "references": [
    {
      "url": "https://github.com/erlang/otp/commit/e4b56a9f4a511aa9990dd86c16c61439c828df83",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/erlang/otp/releases/tag/OTP-27.3.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-440"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25)."
    },
    {
      "lang": "es",
      "value": "Erlang/OTP es un conjunto de librerías para el lenguaje de programación Erlang. En versiones anteriores a OTP-27.3.4 (para OTP-27), OTP-26.2.5.12 (para OTP-26) y OTP-25.3.2.21 (para OTP-25), Erlang/OTP SSH no aplica medidas estrictas de reforzamiento del protocolo de enlace KEX al permitir el intercambio de mensajes opcionales. Esto permite que un atacante intermediario inyecte estos mensajes en una conexión durante el protocolo de enlace. Este problema se ha corregido en las versiones OTP-27.3.4 (para OTP-27), OTP-26.2.5.12 (para OTP-26) y OTP-25.3.2.21 (para OTP-25)."
    }
  ],
  "lastModified": "2026-06-17T09:26:51.230",
  "sourceIdentifier": "security-advisories@github.com"
}