CVE-2025-30095
First published: Mon Mar 31 2025(Updated: )
VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run "rm -f /etc/dropbear/*key*" and/or "rm -f /etc/dropbear-initramfs/*key*" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vyos | >=1.3<=1.5 | |
| Debian |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-30095?
CVE-2025-30095 is considered a high severity vulnerability due to the potential for active man-in-the-middle attacks.
How do I fix CVE-2025-30095?
To fix CVE-2025-30095, upgrade to VyOS version 1.4.2 or later or ensure that unique private host keys are generated for each installation of Dropbear.
Which versions are affected by CVE-2025-30095?
CVE-2025-30095 affects VyOS versions 1.3 through 1.5, along with any Debian-based systems using Dropbear.
What kind of attacks does CVE-2025-30095 enable?
CVE-2025-30095 enables attackers to perform active man-in-the-middle attacks against SSH connections.
Is there a workaround for CVE-2025-30095?
A possible workaround for CVE-2025-30095 is to configure Dropbear to generate unique host keys for each installation.
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/source
- collector/nvd-api
- source/NVD
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/event
- vendor/vyos
- canonical/vyos
- vendor/debian
- canonical/debian