CVE-2025-61939 Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended Endpoints

High 8.7 Published 7 Jan 2026 Updated 7 Jan 2026

An attacker with local network access and DNS control can hijack a reverse SSH connection to intercept data or bypass security controls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-61939?

CVE-2025-61939 is a high-severity server-side request forgery vulnerability in Columbia Weather Systems MicroServer, published on 7 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.

Weakness: CWE-923

Which versions are affected by CVE-2025-61939?

It affects 1 product.

Products include Columbiaweather Weather Microserver Firmware.

How do I fix CVE-2025-61939?

No fix has been published for CVE-2025-61939 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-61939 being exploited?

There is no known exploitation of CVE-2025-61939 in the wild and no public exploit code.

Sources

Also known as GHSA-868w-86hc-x374.