CVE-2016-3116

Severity: medium (CVSS 6.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 19.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-03-22 · updated 2026-06-17

Description

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Affected products

[UNKNOWN] dropbear: through 2015.71

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html
http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html
http://seclists.org/fulldisclosure/2016/Mar/47
https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115
https://matt.ucc.asn.au/dropbear/CHANGES
https://security.gentoo.org/glsa/201607-08
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html

Get alerted when CVE-2016-3116 or the next vulnerability affects your stack