CVE-2025-61939

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

4.4 / 10

Vector String

                                        CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N                                    

Vulnerability Description

An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.

Vulnerability Details

Published Date

January 07, 2026

Last Modified

January 22, 2026

CWE ID

CWE-923

Source

NVD

Vendor

columbiaweather

Product

weather_microserver_firmware

External References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01

CVE-2025-61939

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment