CVE-2001-1473

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2001-01-18 · updated 2026-06-16
Weakness: CWE-310

Description

The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.

Affected products

Ssh: 1.2.24, 1.2.25, 1.2.26, 1.2.27, 1.2.28, 1.2.29 (+2)

References

http://www.kb.cert.org/vuls/id/684820
https://exchange.xforce.ibmcloud.com/vulnerabilities/6603
http://www.kb.cert.org/vuls/id/684820
https://exchange.xforce.ibmcloud.com/vulnerabilities/6603

Get alerted when CVE-2001-1473 or the next vulnerability affects your stack