CVE-2025-14821

OVERVIEW CVE-2025-14821 is a privilege escalation and man-in-the-middle vulnerability affecting libssh on Windows systems. The flaw stems from an insecure default configuration where the library automatically loads SSH configuration files from the C:\etc directory, a location that unprivileged local users can create and modify. This allows attackers to manipulate SSH connections and trusted host information. SEVERITY The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector requiring low complexity and low privilege access. No user interaction is required for exploitation. The impact is severe, affecting all three security pillars: confidentiality (ability to intercept communications), integrity (capacity to modify connections and host trust data), and availability of SSH communications. The attack enables security downgrades and man-in-the-middle attacks against SSH sessions. EXPLOITATION STATUS There is currently no evidence of active exploitation. The EPSS score of 0.00011 indicates minimal real-world exploitation likelihood relative to other CVEs, and the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is currently known to be available. The vulnerability maintains an inactive status on threat intelligence hot lists, suggesting limited community or threat actor attention at present.