CVE-2004-2486
CVE-2004-2486 is a high-severity vulnerability in Dropbear Ssh Project Dropbear Ssh with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 3% (86th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Dropbear Ssh Project Dropbear Ssh
- Published:
- Last modified:
Description
The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
Frequently asked questions
- What is CVE-2004-2486?
- The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
- How severe is CVE-2004-2486?
- CVE-2004-2486 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2004-2486 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (86th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2004-2486?
- CVE-2004-2486 affects Dropbear Ssh Project Dropbear Ssh. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2004-2486?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2004-2486 published?
- CVE-2004-2486 was published on 2004-12-31 and last updated on 2026-06-16.
References
- http://matt.ucc.asn.au/dropbear/CHANGES
- http://secunia.com/advisories/12153
- http://secunia.com/advisories/28935
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7a.shtml
- http://www.osvdb.org/8137
- http://www.securityfocus.com/bid/10803
- http://www.vupen.com/english/advisories/2008/0543
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16810
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40490
Affected products (1)
- cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*
More vulnerabilities in Dropbear Ssh Project Dropbear Ssh
- CVE-2016-7407 — Critical (CVSS 9.8): The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted…
- CVE-2016-7406 — Critical (CVSS 9.8): Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format…
- CVE-2017-9078 — High (CVSS 8.8): The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double…
- CVE-2016-7408 — High (CVSS 8.8): The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or…
- CVE-2020-36254 — High (CVSS 8.1): scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.
- CVE-2021-36369 — High (CVSS 7.5): An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication…