CVE•Published 2026-01-06•Modified 2026-10-07•1 article on news•4 live references•NVD data

CVE-2025-14942Wolfssh · Wolfssh

Vulnerability data via NVD (ingested)

CVSS v3.1

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 69% of all CVEs

Weaknesses (CWE)

CWE-287Improper Authentication

Description

wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must update or apply the fix patch and it’s recommended to update credentials used. This fix is also recommended for wolfSSH server applications. While there aren’t any specific attacks on server applications, the same defect is present. Thanks to Aina Toky Rasoamanana of Valeo and Olivier Levillain of Telecom SudParis for the report.

Timeline

Published 2026-01-06

Modified 2026-10-07

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-14942

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Wolfssh Wolfssh"

All exposed Wolfssh Wolfssh instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Wolfssh"

HTTP body or banner mentions "Wolfssh" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-14942