Security Advisory
CVE-2025-61939
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.