Detections
Analytics

OpenSSH < 10.1 / 10.1p1 Multiple Vulnerabilities

low Nessus Plugin ID 269984

Language:

Synopsis

The SSH server running on the remote host is affected by multiple vulnerabilities.

Description

The version of OpenSSH installed on the remote host is prior to 10.1. It is, therefore, affected by multiple vulnerabilities:

 - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) (CVE-2025-61984)

 - ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (CVE-2025-61985)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to OpenSSH version 10.1/10.1p1 or later.

See Also

https://www.openssh.com/releasenotes.html#10.1p1

Plugin Details

Severity: Low

ID: 269984

File Name: openssh_10_1_p1.nasl

Version: 1.3

Type: remote

Family: Misc.

Published: 10/10/2025

Updated: 11/18/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Low

Base Score: 2.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2025-61984

CVSS v3

Risk Factor: Low

Base Score: 3.6

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Required KB Items: installed_sw/OpenSSH

Patch Publication Date: 10/6/2025

Vulnerability Publication Date: 10/6/2025

Reference Information

CVE: CVE-2025-61984, CVE-2025-61985

IAVA: 2025-A-0729-S, 2025-A-0806