CVE-2002-1360: Cisco IOS

High severity, CVSS 10.0. EPSS: 6.1% chance of exploitation in the next 30 days.

Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.

Affected products

• Cisco IOS: version 12.0s only; version 12.0st only; version 12.1e only; version 12.1ea only; version 12.1t only; version 12.2 only; …
• Fissh SSH Client: version 1.0a_for_windows only
• Intersoft Securenetterm: version 5.4.1 only
• Netcomposite Shellguard SSH: version 3.4.6 only
• Pragma Systems Secureshell: version 2.0 only
• Putty Putty: version 0.48 only; version 0.49 only; version 0.53 only
• Winscp Winscp: version 2.0.0 only

Published 2002-12-23. Last modified 2026-06-16.