This vulnerability (CWE-281) in OpenSSH prior to version 10.3 involves improper preservation of file permissions during scp downloads. Specifically, when scp is run as root using the legacy protocol option (-O) and without the -p flag to preserve file modes, the downloaded file may be created with setuid or setgid bits set. This can lead to security risks by granting elevated privileges to the file unexpectedly. The issue arises from the way scp handles file permission bits during the transfer process.

The impact of this vulnerability is that files downloaded via scp under the specified conditions may have elevated permissions (setuid or setgid) that were not intended by the user. This can potentially allow privilege escalation or unauthorized access if the downloaded file is executed or accessed by other users. The CVSS score of 7.5 reflects a high severity with high impact on confidentiality, integrity, and availability.

No explicit patch or remediation details are provided in the available data. Since the vulnerability affects OpenSSH versions before 10.3, upgrading to OpenSSH 10.3 or later is the recommended mitigation to ensure this issue is resolved. Until then, users should avoid using scp with the -O option as root without the -p flag or consider alternative secure file transfer methods. Patch status is not yet confirmed — check the OpenBSD vendor advisory for current remediation guidance.