CVE-2025-54547

MediumCVSS 5.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g., scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired.

Risk Assessment

The risk includes the possibility of unauthorized file operations after session expiration, potentially leading to data integrity issues or unauthorized access.

Recommendation

Disable SSH session multiplexing or configure appropriate timeouts, and update the SSH client software to a patched version.

Other vulnerabilities in SSH client

CVE-2025-47913High
SSH clients that receive SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Original NVD description (English source)

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Vulnerability data from NVD (NIST) · CISA KEV · EPSS