CVE-2025-47203: Improper Neutralization of Special Elements used in an OS Command

dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used...

CVE-2025-4041

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...

CVE-2025-4041 Use of Hard-coded Credentials Optigo Networks ONS NC600

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...

CVE-2025-4041 Use of Hard-coded Credentials Optigo Networks ONS NC600

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...

CVE-2025-4041

Optigo Networks ONS NC600, versions 4.2.1-084 through 4.7.2-330, are affected by CVE-2025-4041. An attacker who can access the device’s SSH service could leverage system components to execute OS commands on the device. The impact is consistent with a remote command execution risk affecting availa...

PT-2025-19913 · Optigo Networks · Optigo Networks Ons Nc600

Name of the Vulnerable Software and Affected Versions: Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330 Description: An issue exists where an attacker could connect to the device's ssh server and utilize the system's components to perform OS command executions. Recommendations: For...

CVE-2025-4041: Use of Hard-coded Credentials

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...

ROS-20250505-01

The vulnerability in the Golang programming language SSH server is related to the fact that the application does not control internal resources consumption in the ssh packet when working with clients that are slow or do not perform key exchange at all. or do not perform key exchange at all...

GO-2025-3649 Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet

Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet...

golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

✅ Result The server responded to an SSH message ID 80 0x5...

📄 Erlang-Based SSH OTP Pre-Authentication Remote Code Execution

This Metasploit module detect and exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH servers that allows remote command execution. By sending crafted SSH packets, it executes a payload to establish a reverse shell on the target system. The exploit leverages a flaw in...

Man-In-The-Middle (MITM)

github.com/rancher/flee is vulnerable to Man-in-the-Middle MitM attack. The vulnerability is due to improper certificate validation and Fleet automatically trusting remote server SSH certificates if not listed in the knownhosts file, allowing potential spoofing by an attacker...

ROS-20250430-05

Vulnerability of Erlang programming language OTP library set is related to improper packet handling SFTP. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. denial of service Vulnerability of SSH protocol implementation from Erlang/OTP library...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433Erlang-OTP This script is a custom security too...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433Erlang-OTP This script is a custom security too...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433Erlang-OTP This script is a custom security too...

OESA-2025-1461 erlang security update

Security Fixes: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a...

Outlaw cybergang attacking targets worldwide

Introduction In a recent incident response case in Brazil, we dealt with a relatively simple, yet very effective threat focused on Linux environments. Outlaw also known as "Dota" is a Perl-based crypto mining botnet that typically takes advantage of weak or default SSH credentials for its...

Important: runc

Issue Overview: Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid. CVE-2022-1705 Uncontrolled...