Refine your search

3 vulnerabilities found for TTSSH2 by TeraTerm Project

CVE-2026-58317 (GCVE-0-2026-58317)
Vulnerability from cvelistv5
Published
2026-07-17 04:14
Modified
2026-07-17 13:06
Severity ?
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-196 - Unsigned to signed conversion error
Summary
Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
References
Impacted products
Vendor Product Version
TeraTerm Project TTSSH2 Version: 1.00 alpha1   ≤ 3.6.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T13:06:11.360435Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T13:06:39.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TTSSH2",
          "vendor": "TeraTerm Project",
          "versions": [
            {
              "lessThanOrEqual": "3.6.1",
              "status": "affected",
              "version": "1.00 alpha1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-196",
              "description": "Unsigned to signed conversion error",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T04:14:03.592Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://teratermproject.github.io/SA/JVN65294474-en.html"
        },
        {
          "url": "https://teratermproject.github.io/SA/JVN65294474.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65294474/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-58317",
    "datePublished": "2026-07-17T04:14:03.592Z",
    "dateReserved": "2026-07-10T02:15:08.138Z",
    "dateUpdated": "2026-07-17T13:06:39.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60060 (GCVE-0-2026-60060)
Vulnerability from cvelistv5
Published
2026-07-17 04:13
Modified
2026-07-17 13:09
Severity ?
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-130 - Improper handling of length parameter inconsistency
Summary
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
References
Impacted products
Vendor Product Version
TeraTerm Project TTSSH2 Version: 1.00 alpha1   ≤ 3.6.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T13:09:03.491244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T13:09:30.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TTSSH2",
          "vendor": "TeraTerm Project",
          "versions": [
            {
              "lessThanOrEqual": "3.6.1",
              "status": "affected",
              "version": "1.00 alpha1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-130",
              "description": "Improper handling of length parameter inconsistency",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T04:13:38.109Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://teratermproject.github.io/SA/JVN65294474-en.html"
        },
        {
          "url": "https://teratermproject.github.io/SA/JVN65294474.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65294474/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-60060",
    "datePublished": "2026-07-17T04:13:38.109Z",
    "dateReserved": "2026-07-10T02:15:09.033Z",
    "dateUpdated": "2026-07-17T13:09:30.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

jvndb-2026-000099
Vulnerability from jvndb
Published
2026-07-16 14:02
Modified
2026-07-16 14:02
Severity ?
6.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Summary
Multiple vulnerabilities in TTSSH2 plugin of Tera Term
Details
TTSSH2 plugin of Tera Term provided by TeraTerm Project contains the following vulnerabilities:<a href='https://cwe.mitre.org/data/definitions/196.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/130.html' target='_blank'></a><ul><li>Unsigned to Signed Conversion Error (CWE-196) - CVE-2026-58317</li><li>Improper Handling of Length Parameter Inconsistency (CWE-130) - CVE-2026-60060</li></ul>CVE-2026-58317 Yukihiro Nakamura reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-60060 TeraTerm Project reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000099.html",
  "dc:date": "2026-07-16T14:02+09:00",
  "dcterms:issued": "2026-07-16T14:02+09:00",
  "dcterms:modified": "2026-07-16T14:02+09:00",
  "description": "TTSSH2 plugin of Tera Term provided by TeraTerm Project contains the following vulnerabilities:\u003ca href=\u0027https://cwe.mitre.org/data/definitions/196.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/130.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eUnsigned to Signed Conversion Error (CWE-196) - CVE-2026-58317\u003c/li\u003e\u003cli\u003eImproper Handling of Length Parameter Inconsistency (CWE-130) - CVE-2026-60060\u003c/li\u003e\u003c/ul\u003eCVE-2026-58317\r\nYukihiro Nakamura reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2026-60060\r\nTeraTerm Project reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000099.html",
  "sec:cpe": {
    "#text": "cpe:/a:tera_term_project:ttssh2",
    "@product": "TTSSH2",
    "@vendor": "TeraTerm Project",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000099",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN65294474/index.html",
      "@id": "JVN#65294474",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-58317",
      "@id": "CVE-2026-58317",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-60060",
      "@id": "CVE-2026-60060",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in TTSSH2 plugin of Tera Term"
}