libssh EUVD-2025-209270

Exploitation requires a local, low-privileged account on a Windows system running software that uses libssh, because libssh's insecure default automatically loads configuration from C:\etc, a path writable by standard users on default Windows installs. The concrete prerequisite is the ability to create or modify files under C:\etc plus a subsequent libssh-based SSH connection (by another user or service) that consumes the planted configuration. Limiting factors: it is Windows-specific (does not apply to the Linux/RHEL/OpenShift platforms in the CPE list, where C:\etc is irrelevant), needs prior local access (AV:L, PR:L), has high attack complexity (AC:H) due to the dependency on another process actually using the malicious config and on C:\etc being attacker-writable, and is moot if C:\etc is already created with restrictive ACLs.

Signals are broadly consistent toward LOW operational urgency despite a 7.0 (High) CVSS. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access, low privileges, and high attack complexity, while EPSS is 0.01% (1st percentile) and CISA's SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total, matching the C:H/I:H/A:H impact. There is no KEV listing and no public exploit identified. The most important caveat is a scope/applicability mismatch: the description and CWE-427 root cause are explicitly Windows-only (C:\etc), yet every CPE and tag references Red Hat Linux products and OpenShift, where C:\etc does not exist, so the real-world exploitable population is far narrower than the CPE list implies and Linux RHEL deployments are likely affected only insofar as they ship the patched libssh package. Verify with the vendor which platforms are genuinely exploitable before prioritizing. Overall this is a high-CVSS but low-real-world-risk issue: meaningful only on Windows hosts where libssh-based software runs and an attacker already has a local foothold.

An unprivileged user on a shared Windows workstation creates C:\etc and writes a malicious libssh configuration that disables strict host-key checking and forces weak algorithms. When another user or a service later runs a libssh-based SSH client, the planted config takes effect, letting the attacker silently downgrade and intercept the SSH session as a local man-in-the-middle. No public exploit is identified, and the high attack complexity reflects the need to win this configuration-and-timing race against another libssh-using process.