CVE-2016-7406

9.8 criticalEPSS 10%

Critical (9.8) in dropbear ssh project dropbear ssh. EPSS 10% chance of exploitation in the next 30 days.

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-11-01)
CWE: CWE-20
Published: 2017-03-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dropbear_ssh_project:dropbear_ssh

References

http://www.openwall.com/lists/oss-security/2016/09/15/2
http://www.securityfocus.com/bid/92974
https://bugzilla.redhat.com/show_bug.cgi?id=1376353
https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
https://security.gentoo.org/glsa/201702-23

Check your stack JSON