PT-2026-1497 · Wolfssh · Wolfssh

Olivier Levillain · Publicado 2026-01-06 · Atualizado 2026-01-06 · CVE-2025-14942

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfSSH versions 1.4.21 and earlier

Description The wolfSSH key exchange state machine can be manipulated, potentially leading to the exposure of the client’s password in plaintext. This manipulation could also allow an attacker to trick the client into sending a fraudulent signature or bypassing user authentication altogether. The issue affects both client and server applications utilizing wolfSSH.

Recommendations Update to a newer version of wolfSSH or apply the available fix patch. It is recommended to update credentials used with wolfSSH.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2025-14942

Produtos afetados

Wolfssh

Referências · 6

• https://github.com/wolfSSL/wolfssh/pull/855 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14942 · Nota de Segurança
• https://twitter.com/0dayPublishing/status/2008594641348644991 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008596321888854237 · Publicação no Twitter
• https://t.me/CVEtracker/41518 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-14942 · Aviso do Fabricante