CVE-2016-6210: openbsd openssh
Vulnerability summary
CVE-2016-6210 is a medium (CVSS 5.9) vulnerability in openbsd openssh. EPSS estimates a 88.94% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.
Weaponized exploit (Metasploit, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 13-02-2017PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVSS metrics
9 scores · 6 sources · 3 versions- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
88.94%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 88.94% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundOpenSSH 7.2p2 - Username Enumeration
Maturity: poc
OpenSSHd 7.2p2 - Username Enumeration
Maturity: poc
SSH Username Enumeration
auxiliary/scanner/ssh/ssh_enumusers
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat7 products
- openssh< 0:5.3p1-123.el6_9
- openssh-askpass< 0:5.3p1-123.el6_9
- openssh-clients< 0:5.3p1-123.el6_9
- openssh-debuginfo< 0:5.3p1-123.el6_9
- openssh-ldap< 0:5.3p1-123.el6_9
Alpine1 product
- openssh< 6.8_p1-r7 | < 7.2_p2-r1
Debian1 product
- openssh< 1:7.2p2-6 | < 1:6.7p1-5+deb8u3 | < 1:6.0p1-4+deb7u5
Openbsd1 product
- openssh≤ 7.2
Ubuntu1 product
- openssh< 1:6.6p1-2ubuntu2.8 | < 1:7.2p2-4ubuntu2.1
5 vendors · 11 products
References
22 links- www.securitytracker.com/id/1036319VDB Entry
www.debian.org/security/2016/dsa-3626Vendor Advisory- security.gentoo.org/glsa/201612-18Vendor Advisory
- access.redhat.com/errata/RHSA-2017:2029Vendor Advisory
