CVE-2016-7408

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via...

8.8 HighFix available

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.26%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: CVE-2016-7408
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: CVE-2016-7408
Updated: 2026-11-02

EUVDEUVD-2016-8261 No score

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: EUVD-2016-8261
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2qq2-3mq9-pfmj 8.8

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via...

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: GHSA-2qq2-3mq9-pfmj
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSV 8.8

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: CVE-2016-7408
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-7408 8.8

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: DEBIAN-CVE-2016-7408
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7408 8.8

The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

Record: UBUNTU-CVE-2016-7408
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0301 No score

Updated dropbear packages fix security vulnerability

Message printout was vulnerable to format string injection.

If specific usernames including "%" symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server. Also, a dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program (CVE-2016-7406).

dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files (CVE-2016-7607).

dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts (CVE-2016-7408).

Record: MGASA-2016-0301
Updated: 2026-11-02

Affected products

dropbear ssh project ssh

Affected packages

Affected packages
Package	Affected	Fixed
`dropbear` Debian:12	before 2016.74-1	2016.74-1
`dropbear` Debian:13	before 2016.74-1	2016.74-1
`dropbear` Debian:14	before 2016.74-1	2016.74-1
`dropbear` Mageia:5	before 2014.66-1.2.mga5	2014.66-1.2.mga5
`dropbear` Ubuntu:16.04:LTS	All versions, plus listed versions 2014.65-1ubuntu22015.68-12015.70-12015.71-12016.72-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-7408 is a high vulnerability (CVSS 8.8) in Dropbear Ssh Project Ssh, published September 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.26%, the 91st percentile. Fixed in dropbear 2016.74-1.

References

Show 8 moreShow less