openwrt ▾
›
openwrt-25.12 ▾
›
vulnerability
›
CVE-2025-15224
Component Overview
Vulnerability Overview
Name
CVE-2025-15224
Source
NVD (
link
)
Debian (
link
)
Description
When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
CWEs
CWE-287
Published Date
Jan 8, 2026
Updated Date
Jun 17, 2026
Workaround
-
Advisories
https://curl.se/docs/CVE-2025-15224.html
Patch
https://curl.se/docs/CVE-2025-15224.json
Vendor Advisory
https://hackerone.com/reports/3480925
Exploit
http://www.openwall.com/lists/oss-security/2026/01/07/7
Mailing List
Analysis
#
Affected Component
Analysis
libcurl-gnutls
Exploitable
Vulnerability Ratings
#
3.1
CVSSv31
NaN
other
Others affected components
#
Name
Project
Project Version
Version
Status
libcurl
buildroot
2025.02.x
8.20.0
Not Affected
libcurl
buildroot
master
8.21.0
Not Affected
curl
openwrt
master
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
master
8.20.0-r1
Not Affected
curl
yocto
kirkstone
7.82.0
Patched
curl
yocto
master
8.20.0
Not Affected
curl
yocto
scarthgap
8.7.1
Patched
Resolved with patches
#
curl (yocto:kirkstone)
#
Title
Author
Resolve
1
libssh: require private key or user-agent for public key auth
Harry Sintonen <sintonen@iki.fi>
CVE-2025-15224
curl (yocto:scarthgap)
#
Title
Author
Resolve
1
libssh: require private key or user-agent for public key auth
Harry Sintonen <sintonen@iki.fi>
CVE-2025-15224