CVE-2015-5600

Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 03 Aug 2015, 00:00
Last modified:27 May 2026, 16:31

Vulnerability Summary

Overall Risk (default)
high
60/100
CVSS Score
8.5 HIGH
v2.0 (nvd)
EPSS Score
78.36% CRITICAL
78% probability +7.45%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

03 Aug 2015, 00:00
Published
Vulnerability first disclosed
27 May 2026, 16:31
Last Modified
Vulnerability information updated

Description

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 8.5AV:N/AC:L/Au:N/C:P/I:N/A:C

EPSS Trends

Current EPSS score: 78.36%• Percentile: 99%

Techniques & Countermeasures

  • CWE-264•Permissions, Privileges, and Access Controls

    Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • openbsd•openssh

    ≤ 6.9

References (33)