Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in…
Priority LOW 23CWE-130Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TeraTerm Project | TTSSH2 | 1.00 alpha1 – 3.6.1 | — | No fix listed | CNA |
- TTSSH2 VendorTeraTerm Project Affected 1.00 alpha1 – 3.6.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-60060
- 2026-10-03 Alias added: GHSA-qcvw-2hm7-q2rp
References
More TeraTerm Project vulnerabilities
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2017-01493 Untrusted search path in TeraTerm Project The installer of Tera Term CVSS 3.0HIGH 7.8
- TI-2026-41998 Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of… CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-60060 · CVE Program
- CVE-2026-60060 · NVD
- FIRST EPSS
- GHSA-qcvw-2hm7-q2rp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences