CVE-2016-10009

HIGH

OpenSSH < 7.3 - Remote Code Execution via Forwarded SSH-Agent PKCS#11 Module Loading

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-10009. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a vulnerability in OpenSSH's agent forwarding feature, where a malicious SSH server can load a malicious PKCS11 provider via dlopen() when a user connects with agent forwarding enabled. The exploit demonstrates arbitrary code execution by loading a shared library that runs a command upon loading.

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textremotelinux
https://www.exploit-db.com/exploits/40963

This exploit leverages a vulnerability in OpenSSH's agent forwarding feature, where a malicious SSH server can load a malicious PKCS11 provider via dlopen() when a user connects with agent forwarding enabled. The exploit demonstrates arbitrary code execution by loading a shared library that runs a command upon loading.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenSSH (versions prior to the fix in ssh-agent.c 1.215)
No auth needed
Prerequisites: OpenSSH compiled with ENABLE_PKCS11 flag · Agent forwarding enabled · Ability to place a malicious shared library on the victim's filesystem
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (20)

Core 20
Core References
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/40963/
Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/94968
Mailing List, Release Notes mailing-list
http://www.openwall.com/lists/oss-security/2016/12/19/2
Third Party Advisory, VDB Entry vdb-entry
http://www.securitytracker.com/id/1037490
Vendor Advisory vendor-advisory
https://usn.ubuntu.com/3538-1/
Vendor Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2017:2029

Scores

CVSS v3 7.3
EPSS 0.3743
EPSS Percentile 98.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-426
Status published
Products (1)
openbsd/openssh < 7.3
Published Jan 05, 2017
Tracked Since Feb 18, 2026