WaratekVRT Sign in

CVE-2019-6110 OpenSSH

Affected softwareOpenSSH
Severity6.8 Medium CVSS 3.1 3 scores
WeaknessCWE-838
Published31 Jan 2019
Updated14 Oct 2026

Description

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 4 citations · earliest 2020-07-19.
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: total.
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB; first seen 2019-01-11.
  • EPSS 25% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-6110 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cybersecurityworks.com /blog/cyber-risk/how-safe-are-enterprise-data-storage-systems.html 2020-07-19
Reported exploitation cybersecurityworks.com /blog/ransomware/cyber-hygiene-ransomware-is-causing-critical-care-disruption-in-hospitals.html 2020-10-15
Reported exploitation cybersecurityworks.com /blog/ransomware/ryuk-raising-the-temperature-in-healthcare.html 2020-11-02
Reported exploitation info.securin.io /hubfs/Securin%20Ransomware%20Report%202023.pdf 2023-02-14
IndexArtifactStarsFirst seen
Exploit-DB SCP Client - Multiple Vulnerabilities (SSHtranger Things) 2019-01-18
Exploit-DB OpenSSH SCP Client - Write Arbitrary Files 2019-01-11

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.8 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N NVD Primary published
CVSS 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CISA-ADP Secondary
CVSS 2.0 4.0 none AV:N/AC:H/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Products and versions

7 products, 7 version entries
SourceVendorProductSchemeAffected versions
nvd netapp element software generic any version
nvd netapp ontap select deploy generic any version
nvd netapp storage automation store generic any version
nvd openbsd openssh generic ≤ 7.9
nvd siemens scalance x204rna eec firmware generic ＜ 3.2.7
nvd siemens scalance x204rna firmware generic ＜ 3.2.7
nvd winscp winscp generic ≤ 5.13

References

URLTags
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Patch, Third Party Advisory
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c Release Notes
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c Release Notes
https://security.gentoo.org/glsa/201903-16 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190213-0001/ Third Party Advisory
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Third Party Advisory
https://www.exploit-db.com/exploits/46193/ Exploit, Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-412672.html

Timeline
Published2019-01-31By the CVE Program.
VulnCheck KEV: earliest evidence2020-07-19Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2023-02-14Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-10-14NVD's own last-modified date for this record.