Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-01-31 | 2 | General2 |
| 2026-02-01 | 2 | General1PoC1 |
| 2026-02-12 | 1 | General1 |
| 2026-05-19 | 1 | Disclosure1 |
Bash a newline: Exploiting SSH via ProxyCommand, again (CVE-2025-61984) #SSH #RCE #ProxyCommand #ShellExploit #GitSubmodules https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984
Post summary
The tweet references CVE-2025-61984, noting it permits RCE through SSH ProxyCommand, but it provides no evidence of an existing PoC, exploit code, patch, or active exploitation.
Bash a newline: Exploiting SSH via ProxyCommand, again (CVE-2025-61984) https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984
Post summary
The post references a Bash newline vulnerability (CVE‑2025‑61984) that can be exploited via SSH ProxyCommand, linking to a write‑up that likely contains a Proof of Concept, but it does not mention active exploitation, patches, or detailed technical info.
5733-SC1 7.2 through 7.6 - OpenSSH vulnerability. #IBMi CVEID: CVE-2025-61984 DESCRIPTION: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) CWE: CWE-159: Improper Handling of Invalid Use of Special Elements CVSS Source: cve@mitre.org CVSS Base score: 3.6 CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2025-61985 DESCRIPTION: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. CWE: CWE-158: Improper Neutralization of Null Byte or NUL Character CVSS Source: cve@mitre.org CVSS Base score: 3.6 CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Remediation/Fixes IBM i ReleasePTF Number(s) 7.6 SJ09226 7.5 SJ09227 7.4 SJ09257 7.3 SJ09257 7.2 SJ09257
Post summary
The post announces vulnerabilities CVE-2025-61984 and CVE-2025-61985 in OpenSSH, provides detailed technical descriptions and CVSS data, and lists specific IBM i PTF repairs.
@CyberRacheal For those that say port 22, you might want to review CVE-2025-32433, CVE-2024-6387, CVE-2025-61984. Need to review version and patch levels and you still might be vulnerable. Remote access should be frontended with a private VPN. Yes I am paranoid.
Post summary
The tweet mentions several CVEs and advises users to check patch levels, but it offers no technical details, exploit evidence, or patch information.
@reverseame You now can see the full details about CVE-2025-61984 on http://Vulntracker.io
Post summary
The tweet references CVE-2025-61984 and points to an external site for details, but provides no further information on exploitation, patching, or technical specifics.
Bash a newline: Exploiting SSH via ProxyCommand, again (CVE-2025-61984) https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984
Post summary
The content references a blog post about exploiting CVE‑2025‑61984 via SSH ProxyCommand but does not provide detailed technical info, PoC, or evidence of active exploitation.