Skip to content
HackIndex logo

HackIndex

SSH Version-Based Vulnerability Check

3 min read Mar 16, 2026

The SSH banner exposes the server software and version. Matching that against known CVEs identifies exploitable conditions without triggering any authentication. This page covers the most operationally relevant vulnerabilities across OpenSSH and other SSH implementations encountered in lab and real-world environments.

Pull the Version

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
22/tcp open  ssh  OpenSSH 7.4 (protocol 2.0)

For the raw banner:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT 
SSH-2.0-OpenSSH_7.4

The format is SSH-2.0-SOFTWARENAME_VERSION. Note the exact version string before checking CVEs.

OpenSSH Username Enumeration (CVE-2018-15919 and Earlier)

OpenSSH versions before 7.7 are vulnerable to a timing-based username enumeration attack. The server responds differently to valid versus invalid usernames during public key authentication, leaking whether an account exists.

Check the version against the vulnerable range:

  • Vulnerable: OpenSSH < 7.7

  • Fixed: OpenSSH 7.7 and later

For a version reporting 7.4, 7.5, or 7.6, username enumeration is viable. The full technique is covered in SSH User Enumeration.

Terrapin Attack (CVE-2023-48795)

Terrapin is a prefix truncation attack against the SSH handshake that allows an attacker positioned on the network path to downgrade the negotiated connection security. It affects connections using chacha20-poly1305@@openssh.com or any CBC cipher with EtM (Encrypt-then-MAC).

Check whether the server negotiates vulnerable cipher combinations:

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ssh2-enum-algos $TARGET_IP

Look for chacha20-poly1305@@openssh.com in the encryption algorithms, or hmac-*-etm@@openssh.com MACs paired with CBC ciphers.

Confirm Terrapin susceptibility directly:

┌──(kali㉿kali)-[~]
└─$ ssh -vv $USER@$TARGET_IP 2>&1 | grep -i "chacha20\|etm\|selected"

The Terrapin scanner tool gives a definitive result:

┌──(kali㉿kali)-[~]
└─$ go install github.com/RUB-NDS/Terrapin-Scanner@latest
┌──(kali㉿kali)-[~]
└─$ terrapin-scanner --connect $TARGET_IP:$PORT 
================================================================================
Reachable Terrapin Severity: HIGH
================================================================================
The following cipher combinations are potentially vulnerable:
- [email protected] (client-to-server)
- [email protected] (server-to-client)

Affected versions: OpenSSH before 9.6. The fix requires both client and server to be patched. A vulnerable server paired with a patched client is still exploitable if a network attacker can intercept the handshake.

The full exploitation is covered in SSH Terrapin Attack.

libssh Authentication Bypass (CVE-2018-10933)

libssh versions 0.6 through 0.7.5 and 0.8.x before 0.8.4 contain an authentication bypass. The server-side code accepts an SSH_MSG_USERAUTH_SUCCESS message sent by the client as a substitute for a valid login, bypassing the authentication process entirely.

This affects applications and devices that use libssh as a server library, not standard OpenSSH. Check the banner for non-OpenSSH implementations:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT

Banners indicating libssh-based servers include libssh, vendor appliances, and some embedded devices.

Check the version:

  • Vulnerable: libssh 0.6.0 to 0.7.5, 0.8.0 to 0.8.3

  • Fixed: libssh 0.7.6 and 0.8.4+

OpenSSH Double-Free Memory Corruption (CVE-2023-38408)

The ssh-agent in OpenSSH before 9.3p2 has a double-free vulnerability reachable when the agent forwards connections through malicious SSH servers. Exploitation requires controlling a server that a vulnerable client with agent forwarding connects to.

Affected: OpenSSH ssh-agent < 9.3p2

Check the client version on a compromised host:

┌──(kali㉿kali)-[~]
└─$ ssh -V

Check Against searchsploit

Once you have the exact version, check for public exploits:

┌──(kali㉿kali)-[~]
└─$ searchsploit openssh 7.4
┌──(kali㉿kali)-[~]
└─$ searchsploit openssh --id

Filter to remote exploits only:

┌──(kali㉿kali)-[~]
└─$ searchsploit -t openssh --exclude="local|dos" remote

References