# CVE-2025-61939

## Summary

- **CVE ID:** CVE-2025-61939
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-923
- **Published:** Jan 7, 2026
- **Last Modified:** Mar 12, 2026

## Description

An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.

## Affected Products

- Columbia Weather Systems — MicroServer (0)

## References

- [CNA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01)
- [CNA](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.27%
- **EPSS Percentile:** 19.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._