CVE-2019-6110: netapp element_software
Vulnerability summary
CVE-2019-6110 is a medium (CVSS 6.8) vulnerability in netapp element_software. EPSS estimates a 24.90% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 31-01-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
24.90%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+4.00 pp
From 20.91% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundOpenSSH SCP Client - Write Arbitrary Files
Maturity: poc
SCP Client - Multiple Vulnerabilities (SSHtranger Things)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Netapp3 products
Siemens2 products
- scalance_x204rna_firmware< 3.2.7
- scalance_x204rna_eec_firmware< 3.2.7
Ubuntu2 products
- opensshAll versions (No fix recorded)
- openssh-ssh1All versions (No fix recorded)
Debian1 product
- opensshAll versions (No fix recorded)
Openbsd1 product
- openssh≤ 7.9
Winscp1 product
- winscp≤ 5.13
6 vendors · 10 products
References
13 links- security.netapp.com/advisory/ntap-20190213-0001/Third Party Advisory
- cvsweb.openbsd.org/src/usr.bin/ssh/scp.cRelease Notes
- cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.cRelease Notes
