CVE-2016-20012
mediumpriority · track · 33EPSS 0.053 · 93 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
**Update to Firmware Release 2022.0.3 LTS or higher:** - AXC F 2152 (2404267) [Download](http://www.phoenixcontact.net/qr/2404267/firmware) - AXC F 1152 (1151412) [Download](http://www.phoenixcontact.net/qr/1151412/firmware) - AXC F 3152 (1069208) Not yet released **Update to PLCnext Engineer Release 2022.0.1 LTS or higher.**
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
- WorkaroundSICK TDC-E210GC all Firmware versionssick_psirt
Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.
- WorkaroundEndress+Hauser SSG-E210GC all Firmware versionssick_psirt
Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- arturo-b-cmu/cve-2016-20012arturo-b-cmu/cve-2016-20012PoC · poc_in_github
affected products (25)
Products and version ranges known to be affected.
- netapp ontap select deploy administration utilityall versionsnvdUScpe:2.3:a:netapp:ontap_select_deploy_administration_utility:*:*:*:*:*:*:*:*
advisories (5)
Vendor and ecosystem advisories describing this.
- SCA-2025-0009Vulnerabilities affecting SICK TDC-E210GC2025-08-01csaf · sick_psirtDE
SICK has identified multiple vulnerabilities in the SICK TDC-E210GC product. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected. At this time, SICK is not aware of any public exploits specifically targeting these vulnerabilities. Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.
- SCA-2025-0011Vulnerabilities affecting Endress+Hauser SSG-E210GC2025-10-02csaf · sick_psirtDE
Several vulnerabilities in the Endress+Hauser SSG-E210GC product were discoverd. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected.
- VDE-2022-010PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release2022-04-12csaf · phoenix_contact_psirtDE
PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities. Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless. UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152
- WID-SEC-W-2024-0229OpenSSH: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2021-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um Informationen offenzulegen.
- WID-SEC-W-2024-1082Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-05-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS im Zusammenhang mit OpenSSH ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder Dateien zu manipulieren.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (26)
External citations — patches, advisories, analysis.
- https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265cnnvd
- https://github.com/openssh/openssh-portable/pull/270cnnvd
- https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097cnnvd
- https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2016-20012cnnvd
- https://rushter.com/blog/public-ssh-keys/cnnvd
- https://security.netapp.com/advisory/ntap-20211014-0005/cnnvd
- https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeakcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan