{"id":"CVE-2025-61939","title":"An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication","summary":"An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS re…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-923"],"vendor":"columbiaweather","product":"weather_microserver_firmware","affected":["weather_microserver_firmware < MS_4.1_14142"],"patched":["weather_microserver_firmware MS_4.1_14142"],"published":"2026-01-07","updated":"2026-09-30","sourceUpdated":"2026-09-30T23:10:00.237","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61939","references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json","label":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01","label":"ics-cert@hq.dhs.gov"}],"tags":["nvd"],"epss":0.00274,"epssPercentile":0.17871,"ingestedAt":"2026-09-30T22:27:27.734Z","slug":"CVE-2025-61939","body":"## Overview\n\nAn unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.\n\n## Affected\n\n- `weather_microserver_firmware < MS_4.1_14142`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `weather_microserver_firmware MS_4.1_14142`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}