CVE-2026-4541

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB.

CVSS v3 2.5 LOW
CVSS v2.0 1.0 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.0^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:S/C:N/I:P/A:N

Exploitability : 1.5 / Impact : 2.9

Access Vector LOCAL

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/janmojzis/tinyssh/
https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17
https://github.com/janmojzis/tinyssh/issues/101
https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116
https://github.com/janmojzis/tinyssh/pull/102
https://github.com/janmojzis/tinyssh/releases/tag/20260301
https://vuldb.com/?ctiid.352358
https://vuldb.com/?id.352358
https://vuldb.com/?submit.774687

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-22 09:15

Updated : 2026-03-23 14:31

NVD link : CVE-2026-4541

Mitre link : CVE-2026-4541

CVE.ORG link : CVE-2026-4541

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-4541", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.0, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-22T09:15:59.683", "references": [{"url": "https://github.com/janmojzis/tinyssh/", "source": "cna@vuldb.com"}, {"url": "https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17", "source": "cna@vuldb.com"}, {"url": "https://github.com/janmojzis/tinyssh/issues/101", "source": "cna@vuldb.com"}, {"url": "https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116", "source": "cna@vuldb.com"}, {"url": "https://github.com/janmojzis/tinyssh/pull/102", "source": "cna@vuldb.com"}, {"url": "https://github.com/janmojzis/tinyssh/releases/tag/20260301", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.352358", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.352358", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.774687", "source": "cna@vuldb.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB."}, {"lang": "es", "value": "Se ha encontrado una falla en janmojzis tinyssh hasta 20250501. Afectada es una funci\u00f3n desconocida del archivo tinyssh/crypto_sign_ed25519_tinyssh.c del componente Gestor de Firma Ed25519. Esta manipulaci\u00f3n causa una verificaci\u00f3n incorrecta de la firma criptogr\u00e1fica. El ataque est\u00e1 restringido a la ejecuci\u00f3n local. La complejidad del ataque se califica como alta. La explotabilidad se considera dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. Se recomienda actualizar a la versi\u00f3n 20260301 para abordar este problema. Nombre del parche: 9c87269607e0d7d20174df742accc49c042cff17. Se recomienda actualizar el componente afectado. Si desea obtener la mejor calidad de datos de vulnerabilidad, puede que tenga que visitar VulDB."}], "lastModified": "2026-03-23T14:31:37.267", "sourceIdentifier": "cna@vuldb.com"}