OpenSSH (Alpine Linux) CVE-2025-61985

Exploitation conditions cannot be determined from the available data - no vulnerability description, CWE, or CVSS vector was provided. It is unknown whether exploitation requires authentication, a specific SSH configuration option, a particular Alpine Linux branch, or client versus server context. What is known: the fix is in the openssh package on Alpine Linux at version 10.1_p1-r0, implying prior versions are vulnerable. The EPSS score of 0.06% suggests no widespread active exploitation has been observed. Authentication requirements not confirmed from available data.

Risk assessment is severely constrained by missing data. No CVSS vector is available, so attack vector, complexity, required privileges, user interaction, and scope are all unconfirmed. The EPSS score of 0.06% at the 19th percentile indicates low exploitation probability relative to the broader CVE population, which is consistent with the absence of KEV listing and no known public exploit. The vendor (Alpine Linux) is the sole reporting source, and no independent corroboration from NVD, CISA, or upstream OpenSSH maintainers is reflected in the available data. Real-world priority should be treated as LOW-to-MODERATE based solely on EPSS signals, but this assessment could change significantly if CVSS or a detailed vulnerability description becomes available. The absence of data is not confirmation of low severity.

Without a description of the vulnerability class or CVSS vector, a realistic attack scenario cannot be responsibly constructed. If the flaw affects the SSH daemon's network-facing code, an attacker with network access to an exposed SSH port could potentially trigger it; if it is a local privilege escalation or client-side issue, the exposure would be significantly more limited. No public exploit has been identified at time of analysis.