CVE-2025-61939
Published: 07 January 2026
Summary
CVE-2025-61939 is a high-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability in Columbiaweather Weather Microserver Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique SSH (T1021.004); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-21 (Secure Name/Address Resolution Service (Recursive or Caching Resolver)).
Deeper analysis
CVE-2025-61939 affects MicroServer, where an unused function can initiate a reverse SSH connection to a vendor-registered domain without mutual authentication. This vulnerability, associated with CWE-923 (Omission of Security-relevant Information), was published on 2026-01-07 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An attacker on the local network with administrative access to the web server and the ability to manipulate DNS responses can exploit this issue by redirecting the reverse SSH connection to an attacker-controlled device. This allows the attacker to achieve high-impact outcomes, including potential remote code execution or unauthorized access, leveraging the lack of mutual authentication.
Mitigation guidance is provided in CISA ICS Advisory ICSA-26-006-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01, along with the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json. Security practitioners should consult these resources for vendor-specific patches, workarounds, or configuration changes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1172
Vulnerability details
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can…
more
redirect the SSH connection to an attacker controlled device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reverse SSH without mutual auth enables remote access (T1021.004); DNS redirection + unused function directly supports exploitation of the server for RCE/unauth access (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and applying vendor patches or updates to remediate the flaw in the unused reverse SSH function as specified in the CISA advisory.
Prohibits or restricts unnecessary functions like the unused reverse SSH initiator, preventing attackers with web admin access from triggering outbound connections.
Performs data origin authentication and integrity checks on DNS resolution responses to block redirection of the SSH connection to attacker-controlled devices.