CVE-2016-7406: Dropbear SSH Project Dropbear SSH

Critical severity, CVSS 9.8. EPSS: 10.2% chance of exploitation in the next 30 days.

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

Affected products

• Dropbear SSH Project Dropbear SSH: up to and including 2016.73

Published 2017-03-03. Last modified 2026-06-17.