CVE-2025-41256

HIGH7.4

Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint

Published Jun 25, 2025

Modified 8 months ago

Details

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak.

This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.

References

DETECTION

https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-688c-vjrc-84rv

DETECTION

https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-02_Cyberduck_Mountain_Duck_Weak_Hash

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-41256

CVSS Analysis

CVSS v3.1

7.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

7.4/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Cryptography

CWE-328

Weak Hash

Ecosystems

Timeline

PublishedJun 25, 2025

ModifiedJun 25, 2025

CVE-2025-41256 | Mondoo Vulnerability Intelligence