What is the CVSS score of CVE-2016-3116?

CVE-2016-3116 has a CVSS 3.0 base score of 6.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 27.6%.

Is there a public PoC exploit available for CVE-2016-3116?

Yes, a public proof-of-concept exploit is available for CVE-2016-3116. Prioritise patching immediately. EPSS: 27.6%.

Dropbear Ssh CVE-2016-3116

MEDIUM

2016-03-22 cve@mitre.org

Authentication Bypass Dropbear Ssh

6.4

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Mar 22, 2016 - 10:59 cve.org

MEDIUM 6.4

DescriptionCVE.org

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

AnalysisAI

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 27.6%.

Technical ContextAI

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. Affected products include: Dropbear Ssh Project Dropbear Ssh. Version information: before 2016.72.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dropbear Ssh

View all

CVE-2023-48795 MEDIUM This Month POC

5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

CVE-2016-7406 CRITICAL Act Now

9.8 Mar 03

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format

CVE-2013-4421 MEDIUM This Month

5.0 Oct 25

The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial

CVE-2016-7407 CRITICAL Act Now

9.8 Mar 03

The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted Open

CVE-2017-9078 HIGH This Week

8.8 May 19

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double fre

CVE-2016-7408 HIGH This Week

8.8 Mar 03

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2

CVE-2012-0920 HIGH This Week

7.1 Jun 05

Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authen

CVE-2016-7409 MEDIUM This Month

5.5 Mar 03

The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read proce

CVE-2013-4434 MEDIUM This Month

5.0 Oct 25

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depend

CVE-2018-15599 MEDIUM This Month

5.3 Aug 21

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerab

CVE-2017-9079 MEDIUM This Month

4.7 May 19

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

CVE-2016-3116 vulnerability details – vuln.today

Back