VULNERABILITY INTELLIGENCE

CVE-2016-7406

CVSS score9.8 CRITICAL

EPSS probability10.22%

CISA KEVNot currently listed

Published2017-03-03

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Weakness classification

CWE-20: Improper Input Validation

Primary references

cve@mitre.org — Mailing List, Patch, Third Party Advisory
cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Issue Tracking
cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
cve@mitre.org — Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, VDB Entry