Tera Term TTSSH2 CVE-2026-60060

The victim must actively initiate an SSH connection from a Windows system running Tera Term with the TTSSH2 plugin to an SSH server controlled by the attacker. This requires user interaction (UI:R in the CVSS vector), meaning the attacker cannot exploit passively - they must lure the victim via phishing, DNS spoofing, BGP hijacking, or similar redirection techniques. The CVSS vector AV:N/AC:L/PR:N confirms no authentication or special system privileges are required on the attacker's side, and no complex preconditions are needed beyond establishing the malicious server. Exploitation is limited to the Tera Term client process; it does not affect SSH servers the victim normally connects to. The attack surface is Windows-only, restricted to users of the Tera Term terminal emulator specifically, and requires the TTSSH2 plugin to be active (which it is by default in standard Tera Term distributions).

The CVSS 3.0 score of 6.3 (Medium) reflects a balanced but real threat: AV:N/AC:L indicates the attack is network-reachable with low complexity, but UI:R caps severity because the victim must actively initiate the SSH connection to the attacker's server. The Unchanged scope (S:U) and partial C/I/A impacts (all Low) indicate limited blast radius per individual exploitation. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified. The CPE wildcard version field (ttssh2:*) suggests all known TTSSH2 versions are affected, broadening exposure. Critically, the memory disclosure path - where out-of-bounds read contents are transmitted back to the attacker's server - could expose credentials or session artifacts beyond what the Low confidentiality rating implies. No KEV listing and no POC availability reduce urgency, but the social-engineering prerequisite is low-friction in phishing-prone environments. This is a real-risk issue for organizations whose users SSH to external or third-party servers.

An attacker registers a domain, deploys a malicious SSH server, and delivers a phishing message or DNS-redirects a Tera Term user to connect to it. Upon connection initiation, the malicious server responds with SSH handshake packets containing deliberately inconsistent length fields. The TTSSH2 plugin processes these packets, performs out-of-bounds reads from adjacent heap memory, and transmits the leaked content back to the attacker's server - potentially exposing credentials buffered from a prior session or other sensitive process memory. No public proof-of-concept exploit is currently known.