CVE-2025-14821: Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.
Other sources
An insecure default configuration vulnerability exists in libssh on Windows systems where the library automatically loads configuration files from the C:\etc directory. Since this directory can be created and modified by unprivileged local users, an attacker can inject malicious SSH configuration or known-hosts entries. This enables local man-in-the-middle attacks, security downgrades of SSH connections, and manipulation of trusted host information. Exploitation requires only low privileges and no user interaction, posing a significant risk to the confidentiality, integrity, and availability of SSH communications that rely on libssh.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On Windows, configure libssh so it does NOT automatically load SSH configuration/known-hosts files from the C:\etc directory. Ensure the directory path used for libssh configuration is not writable or creatable/modifiable by unprivileged local users.
libssh (Windows) Automatic loading of configuration files from C:\etc = Disable or prevent loading from C:\etc (accessible to unprivileged users) - Compensating control
Restrict permissions on the C:\etc directory used by libssh on Windows so unprivileged local users cannot create or modify SSH configuration or known-hosts entries (e.g., remove write/create permissions for low-privilege users).