{"id":"CVE-2025-14821","aliases":["BELL-CVE-2025-14821","EUVD-2025-209270","GHSA-5jf9-8f86-jhvw","JLSEC-2026-778","RHSA-2026:7067"],"status":"published","title":"Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00135,"percentile":0.03001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2026-03-13T06:08:19.5805Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"Julia","package":"libssh_jll","fixed_in":["0.12.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"libssh_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.1+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3}],"products":[{"vendor":"libssh","product":"libssh"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:7067","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14821","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423148","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/","tags":["Release Notes","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14821","tags":["advisory"]},{"url":"https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases"},{"url":"https://github.com/advisories/GHSA-5jf9-8f86-jhvw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-14821","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14821.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3731","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7067.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14821","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0966","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","tags":["advisory"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","tags":["article"]},{"url":"https://vuldb.com/?ctiid.349709","tags":["article"]},{"url":"https://vuldb.com/?id.349709","tags":["article"]},{"url":"https://vuldb.com/?submit.767120","tags":["article"]},{"url":"https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","tags":["article"]},{"url":"https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2025-14821","title":"Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-04-07T16:34:10.718Z","modified":"2026-11-06T14:46:24.704Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2025-209270","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-04-07T16:34:10Z","modified":"2026-11-06T14:46:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T16:05:20.373498Z"}],"ghsa":[{"id":"GHSA-5jf9-8f86-jhvw","title":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security...","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-04-07T18:31:37Z","modified":"2026-04-25T00:30:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:07:38.391524Z"}],"nvd":[{"id":"CVE-2025-14821","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-04-07T17:16:25.433Z","modified":"2026-11-06T15:17:04.91Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-06T18:00:51.592332Z"}],"osv":[{"id":"BELL-CVE-2025-14821","title":"CVE-2025-14821 does not affect BellSoft software","status":"withdrawn","published":"2026-03-13T06:08:19.5805Z","modified":"2026-04-30T07:15:19.890215Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-14821","title":"Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-04-07T16:34:10.718Z","modified":"2026-11-08T02:30:35.240707752Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-07T03:07:55.437794Z"},{"id":"JLSEC-2026-778","description":"A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the `C:\\etc` directory, which can be created and modified by unprivileged local users.","status":"published","published":"2026-07-23T14:46:44.71Z","modified":"2026-07-25T18:24:54.267336857Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"RHSA-2026:7067","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:46Z","modified":"2026-10-06T10:31:09.520546515Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"}]}}