CVE-2016-7406

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute...

9.8 CriticalFix available

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

10.2%Up 4.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: CVE-2016-7406
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: CVE-2016-7406
Updated: 2026-11-02

EUVDEUVD-2016-8259 No score

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: EUVD-2016-8259
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jvpx-9hv9-4qf6 9.8

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute...

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: GHSA-jvpx-9hv9-4qf6
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSV 9.8

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: CVE-2016-7406
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-7406 9.8

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: DEBIAN-CVE-2016-7406
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7406 9.8

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Record: UBUNTU-CVE-2016-7406
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0301 No score

Updated dropbear packages fix security vulnerability

Message printout was vulnerable to format string injection.

If specific usernames including "%" symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server. Also, a dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program (CVE-2016-7406).

dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files (CVE-2016-7607).

dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts (CVE-2016-7408).

Record: MGASA-2016-0301
Updated: 2026-11-02

Affected products

dropbear ssh project ssh

Affected packages

Affected packages
Package	Affected	Fixed
`dropbear` Debian:12	before 2016.74-1	2016.74-1
`dropbear` Debian:13	before 2016.74-1	2016.74-1
`dropbear` Debian:14	before 2016.74-1	2016.74-1
`dropbear` Debian:7	before 2012.55-1.3+deb7u1, plus listed versions 2012.55-1.3	2012.55-1.3+deb7u1
`dropbear` Mageia:5	before 2014.66-1.2.mga5	2014.66-1.2.mga5
`dropbear` Ubuntu:16.04:LTS	All versions, plus listed versions 2014.65-1ubuntu22015.68-12015.70-12015.71-12016.72-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-7406 is a critical vulnerability (CVSS 9.8) in Dropbear Ssh Project Ssh, published September 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in dropbear 2016.74-1.

References

Show 9 moreShow less