CVE-2025-54547: On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Published Oct 29, 2025

Updated

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Affected Software

1 affected component

OpenSSH OpenSSH

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Converged Cloud Fabric to a version that resolves this vulnerability.
Fixed in 6.2.5
Upgrade
Upgrade Cloud Vision Appliance to a version that resolves this vulnerability.
Fixed in 7.1.0
Upgrade
Upgrade Danz Monitoring Fabric to a version that resolves this vulnerability.
Fixed in 8.4.6
Upgrade
Upgrade Danz Monitoring Fabric to a version that resolves this vulnerability.
Fixed in 8.5.3
Upgrade
Upgrade Danz Monitoring Fabric to a version that resolves this vulnerability.
Fixed in 8.6.2
Upgrade
Upgrade Danz Monitoring Fabric to a version that resolves this vulnerability.
Fixed in 8.7.1
Upgrade
Upgrade Multi-Cloud Director to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Oct 29, 2025

CVE Published

via MITRE·10:45 PM

Data Sourced

via MITRE·10:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-54547?

The severity of CVE-2025-54547 is medium with a score of 5.3.

How do I fix CVE-2025-54547?

To fix CVE-2025-54547, upgrade to the latest remediated software version as recommended.

What is the impact of CVE-2025-54547?

CVE-2025-54547 allows SSH sessions to perform file-system operations after a session timeout if multiplexing is configured on the client side.

Which platforms are affected by CVE-2025-54547?

CVE-2025-54547 affects platforms that have SSH session multiplexing configured on the client side.

Can file-system operations be performed after a timeout due to CVE-2025-54547?

Yes, file-system operations can be performed by multiplexed SSH sessions even after the configured session timeout has expired.