EUVD-2026-94161
GHSA-c487-h25j-24jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No credentials needed (PR:N), but an active MitM position plus a lax host-key callback make it AC:H; server impersonation yields full session read/write (C:H/I:H), no availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
3DescriptionCVE.org
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
AnalysisAI
Host key substitution in wolfSSH clients using ECDSA host keys lets an unauthenticated, network-positioned attacker have the client import an attacker-chosen public key, because ParseECCPubKey() derives the curve from the untrusted KEXDH_REPLY blob rather than from the negotiated host key algorithm, so the attacker's own signature over the substituted key verifies successfully. Exploitation is doubly gated: the attacker must hold an active man-in-the-middle position able to rewrite the key exchange reply, and the client must be deployed with a lax public-key verification callback such as trust-on-first-use, an algorithm-name-only check, or fingerprint matching performed against the already-parsed key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must BOTH hold: (1) the attacker occupies an active network man-in-the-middle position able to modify the KEXDH_REPLY during key exchange, and (2) the wolfSSH client is deployed with a weak public-key verification callback - specifically trust-on-first-use (TOFU), an algorithm-name-only check, or fingerprint matching performed against the already-parsed (attacker-influenced) key. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score of 9.0 (Critical) overstates realistic priority for most fleets because exploitation is doubly gated: it needs both an active on-path man-in-the-middle position (reflected as AT:P in the 4.0 vector / AC:H in a 3.1 mapping) and a client deliberately configured with a lax host-key check callback (TOFU, algorithm-name-only, or fingerprint-against-parsed-key). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed, though vendor metadata states a patch is available from wolfSSL. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all wolfSSH client deployments, focusing on systems using ECDSA host keys and configured with lax public-key verification callbacks such as trust-on-first-use, algorithm-name-only checks, or fingerprint matching against already-parsed keys; apply the vendor's patch per the advisory for CVE-2026-16516 where feasible, and where patching cannot be completed immediately, enforce strict host key verification or switch to non-ECDSA host keys. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR. Rated critical sev
Improper authentication handling in the wolfSSH key-exchange state machine (versions 1.4.21 and earlier) allows an attac
A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. Rated critical severity (CVSS 9
Windows logon token reuse in wolfSSHd versions 1.4.15 through 1.5.0 allows an authenticated low-privilege user to impers
Pre-authentication CPU exhaustion affects wolfSSH servers through 1.5.0 that are built with Diffie-Hellman group-exchang
wolfSSH through 1.5.0, when compiled with the --enable-fwd (WOLFSSH_FWD) TCP/IP forwarding option, fails to apply its fo
An authenticated remote attacker with a valid SSH session can trigger a one-byte out-of-bounds stack write in wolfSSH v1
A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote att
Out-of-bounds read in wolfSSHd on Windows allows authenticated users to leak adjacent stack memory via malformed termina
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today