CVE-2017-9078

highpriority · track · 37EPSS 0.055 · 93 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

5.47% (93rd) EPSS

CVSS 8.5 · high

Is it mine?

5 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.08.5highAV:N/AC:M/Au:S/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 6.8 · impact 10

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-415USprimaryCWE-415US

affected products (5)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Matt Johnston Dropbear SSH≤ 2017.75fstec_bduRU
debian debian linux= 8.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
dropbear ssh project dropbear ssh< 2017.75nvdUScpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*
netapp h410c firmwareall versionsnvdUScpe:2.3:o:netapp:h410c_firmware:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2017-05-19modified 2026-06-17

related (1,210)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-33824US	—OT critical	77.1% (100th)	KEV	2026-04-14
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2025-62215US	—OT critical	4.46% (91st)	KEV	2025-11-11
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2021-22600US	high7.0OT critical	6.59% (94th)	KEV	2022-01-26
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgr…
CVE-2021-26411US	medium5.1OT critical	81.7% (100th)	KEV	2021-03-11
Internet Explorer Memory Corruption Vulnerability
CVE-2020-9859US	high7.8OT critical	0.83% (57th)	KEV	2020-06-05
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6…

+1205 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan