CVE-2025-41256CWE-328

Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint

High · published June 25, 2025

CVSS v3.1
7.4
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak.

This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00130 · 2.4th percentile
Weakness
CWE-328 · Use of Weak Hash
Published
2025-06-25T09:16Z
EPSS history
Timeline
  • 25 JUN 09:16Z
    Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint
    cvelistv5