# CVE-2025-61985: OpenSSH code execution via null byte injection in ssh URIs

Source: https://junglewise.ai/threats/cve-2025-61985-openssh-code-execution-via-null-byte-injection-in-ssh-uris  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-06. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-61985 · Severity: low · CVSS 3.6 · Published 2025-10-06

OpenSSH is a widely used tool for secure remote access to computers and servers. A vulnerability in versions before 10.1 could allow an attacker to execute unauthorized commands if the system is configured to use a specific proxy feature and processes a specially crafted web-like address (URI) from an untrusted source. This could lead to a partial compromise of the affected system's integrity and data.

Technologies: [OpenBSD Openssh](https://junglewise.ai/threats/technologies/openssh), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [OpenBSD](https://junglewise.ai/threats/vendors/openbsd), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-61985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61985 being exploited in the wild.

**How severe is CVE-2025-61985?** Low severity, with a CVSS score of 3.6, published 6 October 2025.

**Which products and versions are affected?** OpenBSD Openssh before 10.1; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6.

**Is there a fix for CVE-2025-61985?** A patch was published on 2025-10-06: OpenSSH 10.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61985 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-61985?** Check whether you run OpenBSD Openssh or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in OpenSSH's handling of ssh:// URIs where the software fails to properly neutralize null bytes ('\0'). If an application or script constructs an ssh command line using a URI from an untrusted source, and the local OpenSSH configuration utilizes a ProxyCommand with %u (username) expansion, an attacker can inject shell expressions. This occurs because the null byte can terminate the intended string and allow subsequent characters to be interpreted as shell commands when the proxy command is executed. The attack requires a specific configuration (ProxyCommand) and the processing of untrusted input. The issue is fixed in OpenSSH 10.1.

## Affected products

- OpenBSD OpenSSH before 10.1
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP before V3.1.6

## Timeline

- 2025-10-06: disclosed: OpenSSH 10.1 release announcement
- 2025-10-06: patched: OpenSSH 10.1 released with fix
- 2025-10-06: advisory: NVD published CVE-2025-61985

## References

- [https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2](https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2)
- [https://www.openssh.com/releasenotes.html](https://www.openssh.com/releasenotes.html)
- [https://www.openwall.com/lists/oss-security/2025/10/06/1](https://www.openwall.com/lists/oss-security/2025/10/06/1)
- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Related threats

- [OpenSSH password authentication bypass on musl libc without PAM](https://junglewise.ai/threats/cve-2026-123158-sshd-in-openssh-before-10-6p2-on-linux-when-musl-libc-is-used)
- [In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.](https://junglewise.ai/threats/cve-2026-73283-in-sshd-in-openssh-before-10-5-the-restrict-keyword-in-authorized)
- [In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.](https://junglewise.ai/threats/cve-2026-73282-in-ssh-in-openssh-before-10-5-a-use-after-free-for-realloc-data)
- [In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally…](https://junglewise.ai/threats/cve-2026-73281-in-ssh-agent-in-openssh-before-10-5-some-operations-can-occur)
- [OpenSSH use-after-free in ssh client during key re-exchange](https://junglewise.ai/threats/cve-2026-60002-openssh-use-after-free-in-ssh-client-during-key-re-exchange)