Net::Dropbear EUVD-2025-209545

Remote network access to services using Net::Dropbear versions before 0.14 for SSH operations. No authentication, user interaction, or special configuration required for basic exploitation (PR:N, UI:N, AC:L). Vulnerable condition exists in default deployments when Net::Dropbear handles SSH authentication or key exchange operations - the bundled libtomcrypt is invoked automatically during standard SSH protocol flows. Scope change indicator (S:C) suggests exploitation can affect components beyond the Perl process itself, likely referring to SSH session compromise enabling access to underlying system resources. Exploitation is limited to scenarios where Net::Dropbear is actually deployed and handling network SSH traffic - pure code installation without active use does not present exploitable attack surface. CVE-2018-12437 side-channel attacks specifically require ability to measure timing variations during cryptographic operations, potentially requiring multiple connection attempts or sustained network proximity for precise measurements, though CVE-2016-6129 signature forgery may achieve compromise in single-attempt attacks.

CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates maximum severity with network-accessible exploitation requiring no authentication, low complexity, and scope change affecting resources beyond the vulnerable component. CISA SSVC framework confirms 'automatable: yes' and 'technical impact: total' aligning with the CVSS assessment. However, SSVC notes 'exploitation: none' - no confirmed active exploitation despite the critical rating. This creates a nuanced risk profile: the vulnerability is technically severe and easily exploitable IF Net::Dropbear is deployed in network-facing SSH services, but real-world impact depends heavily on deployment patterns. Net::Dropbear is a specialized Perl module likely used in custom SSH automation rather than mainstream SSH servers, limiting the attack surface compared to vulnerabilities in OpenSSH or standard Dropbear deployments. The inherited CVE-2016-6129 dates to 2016 and CVE-2018-12437 to 2018 - both old flaws that have been addressed in modern libtomcrypt versions, suggesting this represents a dependency update gap rather than novel vulnerability. Priority should be HIGH for organizations using Net::Dropbear in production SSH services, MEDIUM for development/testing environments, but many Perl deployments may not use this module at all. The 10.0 CVSS represents theoretical maximum impact but practical risk requires confirming Net::Dropbear usage and network exposure.

Attacker identifies a network service using Net::Dropbear for SSH operations (common in automated Perl-based deployment scripts or custom SSH gateways). By intercepting or initiating SSH connections, attacker exploits CVE-2016-6129 to forge RSA signatures, bypassing authentication to gain unauthorized access. Subsequently exploits CVE-2018-12437 timing side-channels during active sessions to extract RSA private keys through repeated cryptographic operations. With compromised credentials and keys, attacker achieves persistent access to SSH services and can pivot to connected systems. No proof-of-concept specific to Net::Dropbear identified, but exploitation techniques for the underlying libtomcrypt CVEs are publicly documented. The automatable nature and lack of required user interaction make this suitable for mass-scanning campaigns targeting Perl-based SSH infrastructure.