Is CVE-2025-61985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61985 being exploited in the wild.

How severe is CVE-2025-61985?

Low severity, with a CVSS score of 3.6, published 6 October 2025.

Which products and versions are affected?

OpenBSD Openssh before 10.1; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6.

Is there a fix for CVE-2025-61985?

A patch was published on 2025-10-06: OpenSSH 10.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61985 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-61985?

Check whether you run OpenBSD Openssh or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61985: OpenSSH code execution via null byte injection in ssh URIs

CVE-2025-61985 · Severity: low · CVSS 3.6 · Published 2025-10-06

OpenSSH is a widely used tool for secure remote access to computers and servers. A vulnerability in versions before 10.1 could allow an attacker to execute unauthorized commands if the system is configured to use a specific proxy feature and processes a specially crafted web-like address (URI) from an untrusted source. This could lead to a partial compromise of the affected system's integrity and data.

Technologies: OpenBSD Openssh, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: OpenBSD, Siemens.

Quick answers

Is CVE-2025-61985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61985 being exploited in the wild.
How severe is CVE-2025-61985?: Low severity, with a CVSS score of 3.6, published 6 October 2025.
Which products and versions are affected?: OpenBSD Openssh before 10.1; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6.
Is there a fix for CVE-2025-61985?: A patch was published on 2025-10-06: OpenSSH 10.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61985 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-61985?: Check whether you run OpenBSD Openssh or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in OpenSSH's handling of ssh:// URIs where the software fails to properly neutralize null bytes ('\0'). If an application or script constructs an ssh command line using a URI from an untrusted source, and the local OpenSSH configuration utilizes a ProxyCommand with %u (username) expansion, an attacker can inject shell expressions. This occurs because the null byte can terminate the intended string and allow subsequent characters to be interpreted as shell commands when the proxy command is executed. The attack requires a specific configuration (ProxyCommand) and the processing of untrusted input. The issue is fixed in OpenSSH 10.1.

Affected products

OpenBSD OpenSSH before 10.1
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6

Timeline

2025-10-06: disclosed: OpenSSH 10.1 release announcement
2025-10-06: patched: OpenSSH 10.1 released with fix
2025-10-06: advisory: NVD published CVE-2025-61985

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.