CVE-2025-10966
mediumpriority · track · 0EPSS 0.004 · 37 %ileDEEUFRRUUSEPSS · scored 2026-10-27
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/ - FixedRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (77)
Products and version ranges known to be affected.
- Microsoft Azure Linux azl3 cmake 3.30.3-10 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_cmake_3.30.3-10_on_3.0
- Microsoft Azure Linux azl3 containerd2 2.0.0-14 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_containerd2_2.0.0-14_on_3.0
- Microsoft Azure Linux azl3 curl 8.11.1-4 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_curl_8.11.1-4_on_3.0
- Microsoft Azure Linux azl3 kernel 6.6.104.2-4 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_kernel_6.6.104.2-4_on_3.0
- Microsoft Azure Linux azl3 kubevirt 1.5.0-5 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_kubevirt_1.5.0-5_on_3.0
- Microsoft Azure Linux azl3 libarchive 3.7.7-3 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_libarchive_3.7.7-3_on_3.0
- Microsoft Azure Linux azl3 libxml2 2.11.5-7 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_libxml2_2.11.5-7_on_3.0
- Microsoft Azure Linux azl3 mysql 8.0.44-2 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_mysql_8.0.44-2_on_3.0
- Microsoft Azure Linux azl3 nghttp2 1.61.0-2 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_nghttp2_1.61.0-2_on_3.0
- Microsoft Azure Linux azl3 runc 1.3.3-1 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_runc_1.3.3-1_on_3.0
- Microsoft Azure Linux azl3 rust 1.75.0-21 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_rust_1.75.0-21_on_3.0
- Microsoft Azure Linux azl3 rust 1.86.0-9 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_rust_1.86.0-9_on_3.0
- Microsoft Windows Subsystem for Linux GUIall versionscert_bundDEcpe:/o:microsoft:windows:subsystem_for_linux_gui
advisories (8)
Vendor and ecosystem advisories describing this.
- SSA-253495SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.02026-06-02csaf · siemens_psirtDE
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
- WID-SEC-W-2025-2489cURL: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-11-04csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-2563Microsoft Azure Linux: Mehrere SchwachstellenDeutsch2025-11-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure Linux und Microsoft Windows ausnutzen um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, die Authentifizierung zu umgehen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-2189Dell PowerProtect Data Domain: Mehrere SchwachstellenDeutsch2026-07-02csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.
- ICSA-26-188-05Siemens SINEC OS2026-06-02icsa · cisa_csaf_otUS
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
- CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- CURL-CVE-2025-10966missing SFTP host verification with wolfSSH2025-11-05vendor · osvUS
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/11/05/2cnnvd
- https://curl.se/docs/CVE-2025-10966.htmlcnnvd
- https://curl.se/docs/CVE-2025-10966.jsoncnnvd
- https://curl.se/download.htmlPatchcnnvd
- https://hackerone.com/reports/3355218cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10966cnnvd
- https://vigilance.fr/vulnerability/curl-Man-in-the-Middle-via-wolfSSH-SFTP-48662cnnvd
- https://curl.se/docs/CVE-2025-10966.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan