CVE-2025-14942

CRITICAL EPSS 26.9%
Published Jan 6, 20265mo ago · Modified Jun 17, 20261w ago
9.4 CVSS 4.0
Critical
Find Similar
Published Jan 6, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must update or apply the fix patch and it’s recommended to update credentials used. This fix is also recommended for wolfSSH server applications. While there aren’t any specific attacks on server applications, the same defect is present. Thanks to Aina Toky Rasoamanana of Valeo and Olivier Levillain of Telecom SudParis for the report.

CVSS Details

Base Score
9.4
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
26.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 1

VendorProductVersionRange
wolfsshwolfssh* <1.4.22

References 1

  • github.com https://github.com/wolfSSL/wolfssh/pull/855
    Issue Tracking

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.