CVE-2012-0920
HIGH · CVSS 7.1EPSS 6.4%EU EUVD
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
Key facts
- CVSS score
- 7.1 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:H/Au:S/C:C/I:C/A:C- Weakness (CWE)
- CWE-399
- EPSS score
- 6.4% (94th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2012-0943)
- Published
- June 5, 2012
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2012-0943 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- debian / debian linux
- debian / debian linux
- dropbear ssh project / dropbear ssh
References
- http://matt.ucc.asn.au/dropbear/CHANGES(Vendor Advisory)
- http://secunia.com/advisories/48147(Third Party Advisory)
- http://secunia.com/advisories/48929(Third Party Advisory)
- http://www.debian.org/security/2012/dsa-2456(Third Party Advisory)
- http://www.osvdb.org/79590(Broken Link)
- http://www.securityfocus.com/bid/52159(Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73444(Third Party Advisory, VDB Entry)
- https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749(Vendor Advisory)
- https://www.mantor.org/~northox/misc/CVE-2012-0920.html(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain