CVE-2016-10010: openbsd openssh
Vulnerability summary
CVE-2016-10010 is a high (CVSS 7.0) vulnerability in openbsd openssh. EPSS estimates a 4.24% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities. 1 public exploit is recorded.
Weaponized exploit (exploit-database, 23-12-2016)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 05-01-2017PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
CVSS metrics
8 scores · 5 sources · 3 versions- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.24%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- openssh< 7.4_p1-r0 | < 6.8_p1-r9 | < 7.2_p2-r3 | < 7.2_p2-r4 | < 7.5_p1-r8
Debian1 product
- openssh< 1:7.4p1-1
Openbsd1 product
- openssh≤ 7.3
Ubuntu1 product
- openssh< 1:7.2p2-4ubuntu2.4
4 vendors · 4 products
References
18 links- www.securityfocus.com/bid/94972VDB Entry
- www.securitytracker.com/id/1037490VDB Entry
- security.freebsd.org/advisories/FreeBSD-SA-17:01.openssh.ascVendor Advisory
