CVE-2025-32728CWE-440

CVE-2025-32728

Medium · published April 10, 2025

CVSS v3.1

4.3

EPSS

Percentile

8.9

In the wild

Unconfirmed

What it is

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00197 · 8.9th percentile
Weakness: CWE-440 · Expected Behavior Violation
Published: 2025-04-10T06:15Z

Affected products (2)

Product	Versions	Fixed in
openbsd/openssh	≥ 7.4, < 10.0	10.0
debian/debian_linux	all versions	—

References (8)

https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig · [email protected]https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 · [email protected]https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html · [email protected]https://www.openssh.com/txt/release-10.0 · [email protected]https://www.openssh.com/txt/release-7.4 · [email protected]https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html · af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20250425-0002/ · af854a3a-2127-422b-91ae-364da2661108 https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

10 APR 00:00Z
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding
cvelistv5