The vulnerability arises because inet_tls_dist:check_ip/1 calls inet:sockname/1 instead of inet:peername/1 to obtain the peer IP address. inet:sockname/1 returns the local socket address, causing the LAN allowlist subnet mask check to always pass regardless of the actual remote IP. Consequently, any entity with a valid CA-signed TLS certificate can bypass the LAN allowlist and gain full Erlang distribution privileges, including remote procedure calls and code loading. This affects Erlang/OTP versions 26.0 before 29.0.2, 28.5.0.2, and 27.3.4.13, and ssl versions 11.0 before 11.7.2, 11.6.0.2, and 11.2.12.9. No official remediation level or patch information is provided in the advisory.

An attacker possessing a CA-signed TLS certificate can bypass the LAN allowlist restriction for Erlang distribution over TLS. This grants unauthorized full access to the Erlang node's distribution capabilities, including executing remote procedure calls (rpc:call/4) and loading arbitrary code (code:load_binary/3), potentially leading to full compromise of the node.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted networks and carefully control issuance and possession of CA-signed TLS certificates to mitigate risk.