CVE-2025-61985CWE-158

CVE-2025-61985

Low · published October 6, 2025

CVSS v3.1
3.6
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00122 · 1.9th percentile
Weakness
CWE-158 · Improper Neutralization of Null Byte or NUL Character
Published
2025-10-06T23:15Z
References (5)
https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2 · [email protected]https://www.openssh.com/releasenotes.html#10.1p1 · [email protected]https://www.openwall.com/lists/oss-security/2025/10/06/1 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-019113.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-457936.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 06 OCT 00:00Z
    ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used
    cvelistv5