CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVSS 3.1

6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-838

Published

2019-01-31

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• netapp:element_software
• netapp:ontap_select_deploy
• netapp:storage_automation_store
• openbsd:openssh
• siemens:scalance_x204rna_eec_firmware
• siemens:scalance_x204rna_firmware
• winscp:winscp

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
• https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
• https://security.gentoo.org/glsa/201903-16
• https://security.netapp.com/advisory/ntap-20190213-0001/

Check your stackJSON