# SSH Version-Based Vulnerability Check

- **URL:** https://hackindex.io/services/ssh/vulnerability-discovery/ssh-version-vulnerability-check
- **Path:** SSH > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ssh/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

The SSH banner exposes the server software and version. Matching that against known CVEs identifies exploitable conditions without triggering any authentication. This page covers the most operationally relevant vulnerabilities across OpenSSH and other SSH implementations encountered in lab and real-world environments.

## SSH Version Vulnerability Check

```bash
nmap -sV -p $PORT $TARGET_IP
# 22/tcp open  ssh  OpenSSH 7.4 (protocol 2.0)
```

For the raw banner:

```bash
nc -nv $TARGET_IP $PORT
# SSH-2.0-OpenSSH_7.4
```

The format is `SSH-2.0-SOFTWARENAME_VERSION`. Note the exact version string before checking CVEs.

## OpenSSH Username Enumeration (CVE-2018-15919 and Earlier)

OpenSSH versions before 7.7 are vulnerable to a timing-based username enumeration attack. The server responds differently to valid versus invalid usernames during public key authentication, leaking whether an account exists.

Check the version against the vulnerable range:

- **Vulnerable**: OpenSSH < 7.7
- **Fixed**: OpenSSH 7.7 and later

For a version reporting 7.4, 7.5, or 7.6, username enumeration is viable. The full technique is covered in [SSH User Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-user-enumeration).

## Terrapin Attack (CVE-2023-48795)

Terrapin is a prefix truncation attack against the SSH handshake that allows an attacker positioned on the network path to downgrade the negotiated connection security. It affects connections using `chacha20-poly1305@openssh.com` or any CBC cipher with EtM (Encrypt-then-MAC).

Check whether the server negotiates vulnerable cipher combinations:

```bash
nmap -p $PORT --script ssh2-enum-algos $TARGET_IP
```

Look for `chacha20-poly1305@openssh.com` in the encryption algorithms, or `hmac-*-etm@openssh.com` MACs paired with CBC ciphers.

Confirm Terrapin susceptibility directly:

```bash
ssh -vv $USER@$TARGET_IP 2>&1 | grep -i "chacha20\|etm\|selected"
```

The Terrapin scanner tool gives a definitive result:

```bash
go install github.com/RUB-NDS/Terrapin-Scanner@latest
terrapin-scanner --connect $TARGET_IP:$PORT
# ================================================================================
# Reachable Terrapin Severity: HIGH
# ================================================================================
# The following cipher combinations are potentially vulnerable:
# - chacha20-poly1305@openssh.com (client-to-server)
# - chacha20-poly1305@openssh.com (server-to-client)
```

Affected versions: OpenSSH before 9.6. The fix requires both client and server to be patched. A vulnerable server paired with a patched client is still exploitable if a network attacker can intercept the handshake.

The full exploitation is covered in [SSH Terrapin Attack](https://hackindex.io/services/ssh/exploitation/ssh-terrapin-attack).

## libssh Authentication Bypass (CVE-2018-10933)

libssh versions 0.6 through 0.7.5 and 0.8.x before 0.8.4 contain an authentication bypass. The server-side code accepts an `SSH_MSG_USERAUTH_SUCCESS` message sent by the client as a substitute for a valid login, bypassing the authentication process entirely.

This affects applications and devices that use libssh as a server library, not standard OpenSSH. Check the banner for non-OpenSSH implementations:

```bash
nc -nv $TARGET_IP $PORT
```

Banners indicating libssh-based servers include `libssh`, vendor appliances, and some embedded devices.

Check the version:

- **Vulnerable**: libssh 0.6.0 to 0.7.5, 0.8.0 to 0.8.3
- **Fixed**: libssh 0.7.6 and 0.8.4+

## OpenSSH Double-Free Memory Corruption (CVE-2023-38408)

The ssh-agent in OpenSSH before 9.3p2 has a double-free vulnerability reachable when the agent forwards connections through malicious SSH servers. Exploitation requires controlling a server that a vulnerable client with agent forwarding connects to.

Affected: OpenSSH ssh-agent < 9.3p2

Check the client version on a compromised host:

```bash
ssh -V
```

## Check Against searchsploit

Once you have the exact version, check for public exploits:

```bash
searchsploit openssh 7.4
searchsploit openssh --id
```

Filter to remote exploits only:

```bash
searchsploit -t openssh --exclude="local|dos" remote
```

## References

- [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795) - Terrapin | NVD entry for the SSH Terrapin prefix truncation attack
- [CVE-2018-15919: OpenSSH user enumeration ](https://nvd.nist.gov/vuln/detail/CVE-2018-15919) - NVD entry for timing-based username enumeration in OpenSSH < 7.7
- [CVE-2018-10933: libssh auth bypass](https://nvd.nist.gov/vuln/detail/CVE-2018-10933) - NVD entry for the libssh server-side authentication bypass
- [RUB-NDS/Terrapin-Scanner](https://github.com/RUB-NDS/Terrapin-Scanner) - Official Terrapin vulnerability scanner from the researchers who discovered CVE-2023-48795