Description
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.
Affected products
columbiaweather: weather microserver firmware; columbiaweather: weather microserver
References2
- github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/i… Third Party Advisory
- www.cisa.gov/news-events/ics-advisories/icsa-26-006-01 Third Party AdvisoryUS Government Resource
Metrics
- CVSS 3.1
-
4.4
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - CVSS 4.0
-
8.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 19 · as of 11 November 2026
- CWE
- CWE-923
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.