CVE-2025-10966

Medium

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification…

curl·NVD-CWE-noinfo·Published 2025-11-07

CVSS

4.3

EPSS

0.00

KEV

Exploits

cve.orgen

205 chars

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

NVDen

205 chars

NVDes

227 chars

El código de curl para gestionar conexiones SSH cuando SFTP se realizaba usando el backend impulsado por wolfSSH era defectuoso y carecía de mecanismos de verificación de host. Esto impide que curl detecte atacantes MitM y más.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	4.3	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.1	Primary	cve.org	4.3	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.1	Primary	cve.org	4.3	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.1	Secondary	NVD	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.1	Secondary	ENISA EUVD	4.3	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N