The vulnerability arises because the inet_tls_dist:check_ip/1 function uses inet:sockname/1 to obtain the IP address for LAN allowlist enforcement instead of inet:peername/1. Since inet:sockname/1 returns the local socket address, the comparison against the subnet mask always succeeds, effectively bypassing the LAN allowlist. This allows an attacker with a CA-signed TLS certificate to bypass network restrictions and gain full Erlang distribution access, including remote procedure calls and code loading. The affected code is in lib/ssl/src/inet_tls_dist.erl. Versions affected include OTP from 26.0 up to but not including 29.0.2, OTP 28.5.0.2, OTP 27.3.4.13, and ssl from 11.0 up to but not including 11.7.2, 11.6.0.2, and 11.2.12.9.

An attacker possessing a CA-signed TLS certificate can bypass the LAN allowlist restriction for Erlang distribution over TLS, gaining unauthorized full access to the node's Erlang distribution capabilities. This includes the ability to perform remote procedure calls (rpc:call/4) and load arbitrary code (code:load_binary/3), potentially leading to full compromise of the affected Erlang node.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to trusted networks and carefully control issuance and use of CA-signed TLS certificates to limit potential exploitation.