Skip to main content

Dropbear Ssh CVE-2016-7408

HIGH
Improper Access Control (CWE-284)
2017-03-03 cve@mitre.org
RCE Authentication Bypass Dropbear Ssh
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 03, 2017 - 16:59 cve.org
HIGH 8.8

DescriptionCVE.org

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

AnalysisAI

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. Affected products include: Dropbear Ssh Project Dropbear Ssh. Version information: before 2016.74.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dropbear Ssh

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2016-3116 MEDIUM POC
6.4 Mar 22

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-c
CVE-2016-7406 CRITICAL
9.8 Mar 03

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format

CVE-2013-4421 MEDIUM
5.0 Oct 25

The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial

CVE-2016-7407 CRITICAL
9.8 Mar 03

The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted Open
CVE-2017-9078 HIGH
8.8 May 19

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double fre
CVE-2012-0920 HIGH
7.1 Jun 05

Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authen
CVE-2016-7409 MEDIUM
5.5 Mar 03

The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read proce
CVE-2013-4434 MEDIUM
5.0 Oct 25

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depend
CVE-2018-15599 MEDIUM
5.3 Aug 21

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerab
CVE-2017-9079 MEDIUM
4.7 May 19

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2016-7408 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy