CVE-2025-48416 – OpenSSH Root Login Hard-Coded Credential Disclosure

The following table lists the changes that have been made to the
CVE-2025-48416 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 551230f0-3615-47bd-b7cc-93e92e730bbf

    May. 21, 2025

    Action Type Old Value New Value
    Added Description An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the “/etc/shadow” file in the firmware image for the “root” user. However, in the default SSH configuration the “PermitRootLogin” is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
    Added CWE CWE-912
    Added Reference https://r.sec-consult.com/echarge
Share the Post:

Related Posts