CVE-2016-7406

published 2017-03-03

CVE-2016-7406: Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username…

Priority P2 61 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	dropbear	< dropbear 2016.74-1 (bookworm)	dropbear 2016.74-1 (bookworm)
dropbear_ssh_project	dropbear_ssh	<= 2016.73	—
dropbear_ssh_project	dropbear_ssh	>= 0 < 2016.74-1	2016.74-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2016.74-1	2016.74-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2016.74-1	2016.74-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2016.74-1	2016.74-1

Detection & IOCs extracted from sources · hover to see the quote

• → Exploit vector targets format string specifiers injected into the username or host argument of Dropbear SSH connections; monitor SSH authentication logs for usernames or hostnames containing printf-style format specifiers (e.g., %s, %x, %n) ↗

• · Vulnerability is fixed in Dropbear SSH version 2016.74; any instance running a version prior to 2016.74 is vulnerable and should be prioritized for patching ↗
• · Debian packages resolved this in version 2016.74-1 across bookworm, bullseye, forky, sid, and trixie; verify installed package version on Debian-based systems ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 9.8 CRITICAL

vendor_debian 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20