CVE-2007-1099

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-26 · updated 2026-06-16

Description

dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.

Affected products

[UNKNOWN] dropbear: before 0.49 — fixed in 0.49

How to fix

Upgrade to a fixed version: [UNKNOWN] dropbear 0.49. Check the vendor advisory for mitigations.

References

http://matt.ucc.asn.au/dropbear/CHANGES
http://osvdb.org/33814
http://secunia.com/advisories/24345
http://www.osvdb.org/32088
http://www.securityfocus.com/bid/22761
http://www.vupen.com/english/advisories/2007/0785
https://exchange.xforce.ibmcloud.com/vulnerabilities/32762
http://matt.ucc.asn.au/dropbear/CHANGES
http://osvdb.org/33814
http://secunia.com/advisories/24345
http://www.osvdb.org/32088
http://www.securityfocus.com/bid/22761

Get alerted when CVE-2007-1099 or the next vulnerability affects your stack