Key Exchange Manipulation in wolfSSH Client Applications from wolfSSL

CVE-2025-14942

What is CVE-2025-14942?

The wolfSSH library, used in various client applications, has a serious flaw in its key exchange state machine. This vulnerability enables an attacker to manipulate the authentication process, risking the exposure of the client’s password in an unencrypted format. Additionally, malicious actors can trick the client into sending invalid signatures or bypassing user authentication altogether. This affects all client applications utilizing wolfSSH versions 1.4.21 and earlier, prompting users to update their software or apply necessary patches. While no specific attacks have targeted server applications, the same vulnerability exists within wolfSSH server environments, necessitating attention and remediation.

References