Python exploit Proof-of-Concept CVE-2025-32433 Unauthenticated Remote Code Execution in Erlang/OTP SSH. I also have a banner grabbing Nuclei template and a Nuclei RCE check.
The Suricata and Zeek IDS logs are in order based on a succesful Paramiko attack, two regular OpenSSH_9.8 connections without attack, two succesful attacks using ProDefense/CVE-2025-32433 and one succesful attack using CVE-2025-32433.yaml by iamnoooob,rootxharsh,pdresearch. Suricata ran with only my own custom rules in suricata.rules.
The Suricata rules only detect unencrypted channel open/request messages, which are assumed to be sent unauthenticated.
I have not tested the rules against realistic traffic logs.
a42d62b326c107401e08c1ee316f28b6CVE-2025-32433.yaml by iamnoooob,rootxharsh,pdresearchca3cc8a7d31514fa9b48636eaec05a78ProDefense/CVE-2025-32433a2de0f306611e0957be704f5b0e35a82Paramiko script