OpenSSH versions prior to 10.3 allow a file transferred with scp to be installed with setuid or setgid bits when the command is executed as root using the legacy scp protocol flag -O and without the -p option to preserve mode. This unintended privilege assignment can cause the file to run with elevated permissions or under an unintended user identity, potentially enabling malicious code execution with higher authority than intended. The weakness is rooted in an improper handling of privilege settings during file transfer (CWE-281).

All installations of OpenBSD OpenSSH released before version 10.3 are affected. The issue occurs when the OpenSSH client or server is invoked by a root user who utilizes scp with the -O flag and omits -p, leading to files that are set to run with setuid or setgid permissions on the destination host.

The flaw carries a CVSS score of 7.5, indicating high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker who can perform scp operations as root—and has the ability to choose the -O flag and omit -p—can transfer a crafted file that will be installed with elevated privileges, enabling local privilege escalation or the execution of code with unintended authority. The likely attack vector is inferred to be a root-initiated scp transfer employing the described flags.