CVE-2025-14942

wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must update or apply the fix patch and it’s recommended to update credentials used. This fix is also recommended for wolfSSH server applications. While there aren’t any specific attacks on server applications, the same defect is present. Thanks to Aina Toky Rasoamanana of Valeo and Olivier Levillain of Telecom SudParis for the report.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wolfSSL/wolfssh/pull/855	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La máquina de estados de intercambio de claves de wolfSSH puede ser manipulada para filtrar la contraseña del cliente en texto claro, engañar al cliente para que envíe una firma falsa, o engañar al cliente para que omita la autenticación de usuario. Esto afecta a las aplicaciones cliente con wolfSSH versión 1.4.21 y anteriores. Los usuarios de wolfSSH deben actualizar o aplicar el parche de corrección y se recomienda actualizar las credenciales utilizadas. Esta corrección también se recomienda para las aplicaciones servidor de wolfSSH. Aunque no hay ataques específicos en las aplicaciones servidor, el mismo defecto está presente. Gracias a Aina Toky Rasoamanana de Valeo y Olivier Levillain de Telecom SudParis por el informe.

Information

Published : 2026-01-06 18:15

Updated : 2026-10-07 09:10

NVD link : CVE-2025-14942

Mitre link : CVE-2025-14942

CVE.ORG link : CVE-2025-14942

JSON object : View

Products Affected

wolfssh

wolfssh

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-14942", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14942", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-06T18:15:07.033357Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "facts@wolfssl.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "facts@wolfssl.com", "affectedData": [{"vendor": "wolfSSL", "product": "wolfSSH", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.22", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-06T18:15:42.257", "references": [{"url": "https://github.com/wolfSSL/wolfssh/pull/855", "tags": ["Issue Tracking"], "source": "facts@wolfssl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "facts@wolfssl.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "wolfSSH\u2019s key exchange state machine can be manipulated to leak the client\u2019s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must update or apply the fix patch and it\u2019s recommended to update credentials used. This fix is also recommended for wolfSSH server applications. While there aren\u2019t any specific attacks on server applications, the same defect is present. Thanks to Aina Toky Rasoamanana of Valeo and Olivier Levillain of Telecom SudParis for the report."}, {"lang": "es", "value": "La m\u00e1quina de estados de intercambio de claves de wolfSSH puede ser manipulada para filtrar la contrase\u00f1a del cliente en texto claro, enga\u00f1ar al cliente para que env\u00ede una firma falsa, o enga\u00f1ar al cliente para que omita la autenticaci\u00f3n de usuario. Esto afecta a las aplicaciones cliente con wolfSSH versi\u00f3n 1.4.21 y anteriores. Los usuarios de wolfSSH deben actualizar o aplicar el parche de correcci\u00f3n y se recomienda actualizar las credenciales utilizadas. Esta correcci\u00f3n tambi\u00e9n se recomienda para las aplicaciones servidor de wolfSSH. Aunque no hay ataques espec\u00edficos en las aplicaciones servidor, el mismo defecto est\u00e1 presente. Gracias a Aina Toky Rasoamanana de Valeo y Olivier Levillain de Telecom SudParis por el informe."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "217566DD-A8FE-408E-9B8C-A08F5F631995", "versionEndExcluding": "1.4.22"}], "operator": "OR"}]}], "sourceIdentifier": "facts@wolfssl.com"}