CVE-2025-61984CWE-159

CVE-2025-61984

Low · published October 6, 2025

CVSS v3.1
3.6
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-159 · Improper Handling of Invalid Use of Special Elements
Published
2025-10-06T23:15Z
References (10)
https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2 · [email protected]https://www.openssh.com/releasenotes.html#10.1p1 · [email protected]https://www.openwall.com/lists/oss-security/2025/10/06/1 · [email protected]http://www.openwall.com/lists/oss-security/2025/10/07/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/10/12/1 · af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/cve-2025-61984-detection-script-remote-code-execution-vulnerability-affecting-openssh · af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/cve-2025-61984-mitigation-script-remote-code-execution-vulnerability-affecting-openssh · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-019113.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-457936.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 OCT 00:00Z
    ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution…
    cvelistv5