CVE-2025-10966

MEDIUM

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS v3.1 Score

4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Published: 11/7/2025Modified: 10/19/2026

Related Intelligence (1)

CRITICALVulnerability

Siemens SINEC OS

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.</strong></p> <p>The following versions of Siemens SINEC OS are affected:

CVE-2025-1352CVE-2025-1376
CISA Advisories

References (5)

https://curl.se/docs/CVE-2025-10966.htmlPatchVendor Advisoryhttps://curl.se/docs/CVE-2025-10966.jsonVendor Advisoryhttps://hackerone.com/reports/3355218ExploitIssue Trackinghttp://www.openwall.com/lists/oss-security/2025/11/05/2Mailing ListPatchhttps://cert-portal.siemens.com/productcert/html/ssa-253495.html