CVE-2016-3116

MEDIUM

Dropbear SSH <2016.72 - Auth Bypass

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2016-3116. PoCs published by tintinweb, mxypoo.

AI-analyzed exploit summary This exploit demonstrates a CRLF injection vulnerability in Dropbear SSH server's X11 forwarding feature, allowing authenticated users to inject arbitrary xauth commands via newline characters in the x11 cookie. This can lead to forced-command bypass, arbitrary file read/write, and information leakage.

Description

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Exploits (2)

exploitdb WORKING POC

by tintinweb · remotelinux

https://www.exploit-db.com/exploits/40119

View Code ZIP pw:eip

This exploit demonstrates a CRLF injection vulnerability in Dropbear SSH server's X11 forwarding feature, allowing authenticated users to inject arbitrary xauth commands via newline characters in the x11 cookie. This can lead to forced-command bypass, arbitrary file read/write, and information leakage.

Classification

Working Poc 100%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Dropbear SSH server <= 2015.71

Auth required

Prerequisites: X11Forwarding enabled · Authenticated user access

MITRE ATT&CK

T1059 - Command and Scripting Interpreter T1202 - Indirect Command Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 2 stars

by mxypoo · poc

https://github.com/mxypoo/CVE-2016-3116-DropbearSSH

View Code ZIP pw:eip

This is a functional exploit for CVE-2016-3116, targeting Dropbear SSH's X11 forwarding vulnerability. It leverages malformed X11 forwarding requests to achieve arbitrary file read/write and command execution on vulnerable systems.