CVE-2025-10966
Full vulnerability record from the local CVENow database.
Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Modified
Source identifier
2499f714-1537-4658-8207-48ae4bb9eae9
Published
2025-11-07 08:15:39.617000
Last modified
2026-10-19 13:10:00.110000
View original CVE JSON
{
"id": "CVE-2025-10966",
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
"published": "2025-11-07T08:15:39.617",
"lastModified": "2026-10-19T13:10:00.110",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more."
},
{
"lang": "es",
"value": "El código de curl para gestionar conexiones SSH cuando SFTP se realizaba usando el backend impulsado por wolfSSH era defectuoso y carecía de mecanismos de verificación de host. Esto impide que curl detecte atacantes MitM y más."
}
],
"affected": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"affectedData": [
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.69.0",
"lessThan": "8.14.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.15.0",
"lessThan": "8.16.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"repo": "https://github.com/curl/curl.git",
"versions": [
{
"version": "6773c7ca65cf2183295e56603f9b86a5ce816a06",
"lessThan": "b011e3fcfb06d6c0278595ee2ee297036fbe9793",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.16.0",
"status": "affected"
},
{
"version": "8.15.0",
"status": "affected"
},
{
"version": "8.14.1",
"status": "affected"
},
{
"version": "8.14.0",
"status": "affected"
},
{
"version": "8.13.0",
"status": "affected"
},
{
"version": "8.12.1",
"status": "affected"
},
{
"version": "8.12.0",
"status": "affected"
},
{
"version": "8.11.1",
"status": "affected"
},
{
"version": "8.11.0",
"status": "affected"
},
{
"version": "8.10.1",
"status": "affected"
},
{
"version": "8.10.0",
"status": "affected"
},
{
"version": "8.9.1",
"status": "affected"
},
{
"version": "8.9.0",
"status": "affected"
},
{
"version": "8.8.0",
"status": "affected"
},
{
"version": "8.7.1",
"status": "affected"
},
{
"version": "8.7.0",
"status": "affected"
},
{
"version": "8.6.0",
"status": "affected"
},
{
"version": "8.5.0",
"status": "affected"
},
{
"version": "8.4.0",
"status": "affected"
},
{
"version": "8.3.0",
"status": "affected"
},
{
"version": "8.2.1",
"status": "affected"
},
{
"version": "8.2.0",
"status": "affected"
},
{
"version": "8.1.2",
"status": "affected"
},
{
"version": "8.1.1",
"status": "affected"
},
{
"version": "8.1.0",
"status": "affected"
},
{
"version": "8.0.1",
"status": "affected"
},
{
"version": "8.0.0",
"status": "affected"
},
{
"version": "7.88.1",
"status": "affected"
},
{
"version": "7.88.0",
"status": "affected"
},
{
"version": "7.87.0",
"status": "affected"
},
{
"version": "7.86.0",
"status": "affected"
},
{
"version": "7.85.0",
"status": "affected"
},
{
"version": "7.84.0",
"status": "affected"
},
{
"version": "7.83.1",
"status": "affected"
},
{
"version": "7.83.0",
"status": "affected"
},
{
"version": "7.82.0",
"status": "affected"
},
{
"version": "7.81.0",
"status": "affected"
},
{
"version": "7.80.0",
"status": "affected"
},
{
"version": "7.79.1",
"status": "affected"
},
{
"version": "7.79.0",
"status": "affected"
},
{
"version": "7.78.0",
"status": "affected"
},
{
"version": "7.77.0",
"status": "affected"
},
{
"version": "7.76.1",
"status": "affected"
},
{
"version": "7.76.0",
"status": "affected"
},
{
"version": "7.75.0",
"status": "affected"
},
{
"version": "7.74.0",
"status": "affected"
},
{
"version": "7.73.0",
"status": "affected"
},
{
"version": "7.72.0",
"status": "affected"
},
{
"version": "7.71.1",
"status": "affected"
},
{
"version": "7.71.0",
"status": "affected"
},
{
"version": "7.70.0",
"status": "affected"
},
{
"version": "7.69.1",
"status": "affected"
},
{
"version": "7.69.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V4.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-10T20:26:03.531168Z",
"id": "CVE-2025-10966",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-322"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.69.0",
"versionEndExcluding": "8.17.0",
"matchCriteriaId": "8305F329-73B7-4DFC-9EA2-AD77D31E14A9"
}
]
}
]
}
],
"references": [
{
"url": "https://curl.se/docs/CVE-2025-10966.html",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://curl.se/docs/CVE-2025-10966.json",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://hackerone.com/reports/3355218",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/05/2",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}