A critical vulnerability in libssh allows local attackers to compromise the integrity and confidentiality of SSH connections by manipulating configuration paths on Windows systems.

The flaw is an uncontrolled search path element (CWE-427) where the library automatically loads configuration files from the C:\etc directory. This allows an authenticated local user with low privileges to create or modify these files, leading to SSH security downgrades and man-in-the-middle attacks.

Successful exploitation allows an attacker to intercept or manipulate encrypted SSH traffic, potentially leading to the theft of credentials or unauthorized command execution. Given the CVSS score of 7.8, this vulnerability poses a high risk to organizational security, as it undermines the fundamental trust mechanisms used for secure remote administration and data transfer.

Immediate Action: Update the libssh library to version 0.12.0-1.1.hum1 or later as provided by the vendor to resolve the insecure search path behavior.

Proactive Monitoring: Audit local file system permissions on Windows hosts to ensure that unprivileged users cannot modify directories or files within the C:\etc path.

Compensating Controls: Implement strict host-based access controls and monitor for unauthorized creation of configuration files in system-level directories.

Public Exploit Available: Unknown

Organizations utilizing libssh on Windows environments should prioritize this update to prevent local attackers from hijacking secure sessions. Administrators must verify that the library is no longer loading configuration files from untrusted, user-writable directories to fully remediate the risk.