CVE-2016-10009

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 37.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-01-05 · updated 2026-06-17
Weakness: CWE-426

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

Affected products

OpenSSH: through 7.3

References

http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html
http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Jul/31
http://www.openwall.com/lists/oss-security/2016/12/19/2
http://www.openwall.com/lists/oss-security/2023/07/19/9
http://www.openwall.com/lists/oss-security/2023/07/20/1
http://www.securityfocus.com/bid/94968
http://www.securitytracker.com/id/1037490
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
https://access.redhat.com/errata/RHSA-2017:2029
https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Get alerted when CVE-2016-10009 or the next vulnerability affects your stack