CVE-2025-11625
📋 TL;DR
An improper host authentication vulnerability in wolfSSH clients up to version 1.4.20 allows attackers to bypass authentication and potentially leak client credentials. This affects any system using vulnerable wolfSSH client implementations for SSH connections. The vulnerability enables man-in-the-middle attacks against SSH sessions.
💻 Affected Systems
- wolfSSH client
📦 What is this software?
Wolfssh by Wolfssh
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of SSH sessions allowing credential theft, data interception, and unauthorized access to systems the client connects to.
Likely Case
Credential theft and session hijacking when clients connect through untrusted networks or to malicious servers.
If Mitigated
Limited impact if connections only occur within trusted networks with proper certificate validation.
🎯 Exploit Status
Exploitation requires man-in-the-middle position or ability to redirect client connections. The vulnerability is in host key verification logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.21 or later
Vendor Advisory: https://github.com/wolfSSL/wolfssh/pull/840
Restart Required: Yes
Instructions:
1. Update wolfSSH to version 1.4.21 or later. 2. Recompile any applications using wolfSSH library. 3. Restart affected applications/services.
🔧 Temporary Workarounds
Disable vulnerable SSH connections
allTemporarily disable SSH client functionality using wolfSSH until patched
Use alternative SSH client
allReplace wolfSSH client with OpenSSH or other validated SSH implementations
🧯 If You Can't Patch
- Restrict SSH connections to trusted networks only
- Implement certificate pinning or strict host key checking if supported
🔍 How to Verify
Check if Vulnerable:
Check wolfSSH version: wolfssh-config --version or examine library version in applicationCheck Version:
wolfssh-config --versionVerify Fix Applied:
Verify version is 1.4.21 or later and test SSH connections with invalid host keys (should fail)📡 Detection & Monitoring
Log Indicators:
- Failed host key verification attempts
- Unexpected SSH connection successes
Network Indicators:
- SSH connections to unexpected hosts
- Man-in-the-middle attack patterns
SIEM Query:
source="ssh" AND (event="connection_success" OR event="auth_bypass")