CVE-2018-10933
mediumpriority · attend · 78EPSS 0.918 · 100 %ileexploit · functionalDEEURUUSEPSS · scored 2026-10-22
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationXMC20 R4 using COGE5cisa_csaf_ot
Do not directly connect control systems to the Internet.
- MitigationXMC20 R6 using COGE5cisa_csaf_ot
Do not directly connect control systems to the Internet.
- MitigationFOX61x R1 using CESM1/CESM2cisa_csaf_ot
Hitachi ABB Power Grids recommends security practices and firewall configurations to help protect a process control network from attacks originating from outside the network. Such practices require process control systems be physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by a firewall system that has a minimal number of ports exposed. Other systems must be evaluated on case-by-case basis. Process control systems should not be used for Internet browsing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationFOX61x R2 using CESM1/CESM2cisa_csaf_ot
Hitachi ABB Power Grids recommends security practices and firewall configurations to help protect a process control network from attacks originating from outside the network. Such practices require process control systems be physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by a firewall system that has a minimal number of ports exposed. Other systems must be evaluated on case-by-case basis. Process control systems should not be used for Internet browsing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (42)
Public proof-of-concept and weaponised exploit code.
- EDB-46307LibSSH 0.7.6 / 0.8.4 - Unauthorized Accessfunctional · exploit_db
- auxiliary/scanner/ssh/libssh_auth_bypasslibssh Authentication Bypass Scannerfunctional · metasploit
- EDB-45638libSSH - Authentication BypassPoC · exploit_db
- 0xadaw/libSSH-bypassImplementation of CVE-2018-10933 with CIDR block scanner PoC · poc_in_github
- AVA-CEO/CVE-2018-10933-Assessment-AVA-CEO/CVE-2018-10933-Assessment-PoC · poc_in_github
- Bifrozt/CVE-2018-10933CVE-2018-10933PoC · poc_in_github
affected products (30)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1051libssh: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2018-10-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- cisco-sa-20181019-libsshlibssh Authentication Bypass Vulnerability Affecting Cisco Products: October 20182018-10-19csaf · cisco_csafUS
A vulnerability in libssh could allow an unauthenticated, remote attacker to bypass authentication on a targeted system. The vulnerability is due to improper authentication operations by the server-side state machine of the affected software. An attacker could exploit this vulnerability by presenting a SSH2_MSG_USERAUTH_SUCCESS message to a targeted system. A successful exploit could allow the attacker to bypass authentication and gain unauthorized access to a targeted system.
- ICSA-20-294-02Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer2020-10-20icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to remotely take control of the product.
- ICSA-21-007-01Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer2021-01-07icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker remote access to the device without authentication.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (38)
External citations — patches, advisories, analysis.
- http://www.securityfocus.com/bid/105677cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933cnnvd
- https://lists.debian.org/debian-lts-announce/2018/10/msg00010.htmlcnnvd
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016cnnvd
- https://security.netapp.com/advisory/ntap-20190118-0002/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-294-02cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-007-01cnnvd
- https://usn.ubuntu.com/3795-1/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan