PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-61939 Columbia Weather Systems CVE debrief

CISA's ICSA-26-006-01, published on 2026-01-06 and revised the same day, describes a weakness in Columbia Weather Systems MicroServer firmware. An unused function can start a reverse SSH connection to a vendor-registered domain without mutual authentication. If an attacker already has local-network access and admin access to the web server, and can manipulate DNS responses, they may redirect that SSH connection to an attacker-controlled device.

Vendor
Columbia Weather Systems
Product
MicroServer firmware
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-07
Original CVE updated
2026-09-30
Advisory published
2026-01-07
Advisory updated
2026-09-30

Who should care

Columbia Weather Systems MicroServer firmware owners, industrial control system operators, and administrators responsible for the device's web interface, remote access, or network DNS controls.

Technical summary

The advisory describes an unused MicroServer function that can initiate a reverse SSH connection to a vendor-registered domain. Because the connection lacks mutual authentication, an attacker who meets the stated preconditions—local-network access, admin access to the web server, and the ability to manipulate DNS responses—could redirect the SSH connection to a device they control.

Defensive priority

High. The advisory rates the issue CVSS 8.8, and the potential impact is significant, but the exposure is not universal: the attacker needs local-network presence, administrative access to the web server, and DNS manipulation capability.

Recommended defensive actions

  • Update MicroServer firmware to MS_4.1_14142 or later, as recommended by Columbia Weather Systems.
  • Contact Columbia Weather Systems Support directly at [email protected] or 503-629-0887 to obtain the update and apply it through the vendor process.
  • Restrict administrative access to the MicroServer web server and segment the device on trusted management networks.
  • Protect DNS responses and management-plane name resolution from spoofing or unauthorized changes.
  • Follow CISA industrial control system recommended practices for access control, segmentation, and monitoring around the device.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-006-01 for CVE-2025-61939 and its revision history, which records an initial publication and a same-day revision updating risk evaluation, research acknowledgment, and vendor mitigations. The source corpus does not indicate a KEV listing or ransomware use.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-61939 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-61939

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-61939 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61939

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-006-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.