CVE-2025-47203

MEDIUM

Dropbear SSH <2025.88 - Command Injection

Title source: llm

dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.

Core 8

Core References

Various Sources

Various Sources

Mailing List

Mailing List

Mailing List

Mailing List

Mailing List

Mailing List

CVSS v3 4.5

EPSS 0.0019

EPSS Percentile 41.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-78

Status published

Products (1)

Dropbear SSH Project/Dropbear SSH < 2025.88

Published May 07, 2025

Tracked Since Feb 18, 2026