CVE-2021-45099

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-16 · updated 2026-06-17

Description

The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations

Affected products

Ssh & Web Terminal Project Ssh & Web Terminal: before 10.0.0 — fixed in 10.0.0

How to fix

Upgrade to a fixed version: Ssh & Web Terminal Project Ssh & Web Terminal 10.0.0. Check the vendor advisory for mitigations.

References

https://gist.github.com/Eriner/0872628519f70556d2c26c83439a9f67
https://github.com/hassio-addons/addon-ssh/releases/tag/v10.0.0
https://gist.github.com/Eriner/0872628519f70556d2c26c83439a9f67
https://github.com/hassio-addons/addon-ssh/releases/tag/v10.0.0

Get alerted when CVE-2021-45099 or the next vulnerability affects your stack