Executive brief
OpenSSH is a widely used tool for secure remote access to computers and servers. A vulnerability in versions before 10.1 could allow an attacker to execute unauthorized commands if the system is configured to use a specific proxy feature and processes a specially crafted web-like address (URI) from an untrusted source. This could lead to a partial compromise of the affected system's integrity and data.
Technical details
A vulnerability exists in OpenSSH's handling of ssh:// URIs where the software fails to properly neutralize null bytes ('\0'). If an application or script constructs an ssh command line using a URI from an untrusted source, and the local OpenSSH configuration utilizes a ProxyCommand with %u (username) expansion, an attacker can inject shell expressions. This occurs because the null byte can terminate the intended string and allow subsequent characters to be interpreted as shell commands when the proxy command is executed. The attack requires a specific configuration (ProxyCommand) and the processing of untrusted input. The issue is fixed in OpenSSH 10.1.
Affected products
- OpenBSD OpenSSH before 10.1
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6
Timeline
- 2025-10-06: disclosed: OpenSSH 10.1 release announcement
- 2025-10-06: patched: OpenSSH 10.1 released with fix
- 2025-10-06: advisory: NVD published CVE-2025-61985