Security readout for executives and security teams
Plain-English summary
CVE-2025-48040 is a denial-of-service risk in Erlang/OTP's SSH SFTP code. A remote, unauthenticated attacker could send malicious SSH key exchange messages that cause excessive resource use, potentially reducing service availability. The available sources do not show data theft or code execution impact.
Executive priority
Treat as a near-term availability fix for exposed Erlang/OTP SSH/SFTP services. It is not evidenced as exploited or data-compromising, but unauthenticated network reachability makes outage risk credible.
Technical view
The issue is uncontrolled resource consumption in Erlang OTP ssh_sftp modules, associated with lib/ssh/src/ssh_sftpd.erl. It is mapped to CWE-400 and CWE-770, with CVSS 4.0 score 6.9. Affected ranges span OTP 17.0 through specified 26, 27, and 28 branch levels, corresponding to ssh 3.0.1 through listed branch versions.
Likely exposure
Exposure is most likely where Erlang/OTP applications run the OTP SSH/SFTP server component on a network-reachable interface. Systems using affected OTP versions but not enabling ssh_sftp are less likely to be exposed. Internet-facing SSH/SFTP services should be prioritized.
Exploitation context
The bundle marks KEV as false, and no cited source states active exploitation. The vulnerability is remotely reachable, low complexity, unauthenticated, and availability-focused. Evidence provided does not support claims of code execution, privilege escalation, or confidentiality impact.
Researcher notes
The source bundle indicates affected OTP versions from 17.0 through branch-specific upper bounds and references upstream patches. Exact fixed-release interpretation should be confirmed against Erlang advisory wording before enforcement. Focus validation on ssh_sftpd usage, not merely OTP presence.
Mitigation direction
- Apply Erlang/OTP vendor updates or patches from the advisory and linked commits.
- Prioritize internet-facing OTP SSH/SFTP services before internal-only deployments.
- Restrict network access to OTP SSH/SFTP services where business requirements allow.
- Monitor vendor guidance for exact fixed branch versions and backports.
- Use operational rate limiting or connection controls where available.
Validation and detection
- Inventory Erlang/OTP versions and included ssh application versions.
- Confirm whether the OTP ssh_sftp server module is enabled or reachable.
- Compare deployed versions against the vendor advisory affected ranges.
- Review external exposure for OTP-based SSH/SFTP endpoints.
- Verify patched builds include the referenced upstream fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-48040 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——EEFVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cphCVE reference, EEF · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2025-48040.htmlCVE reference, EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2025-48040CVE reference, EEF · related
- https://www.erlang.org/doc/system/versions.html#order-of-versionsCVE reference, EEF · x_version-scheme
- https://github.com/erlang/otp/pull/10162CVE reference, EEF · patch
- https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181aCVE reference, EEF · patch
- https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5aCVE reference, EEF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.