CVE-2001-1476 json
SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portion…
published 2001-01-18 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-1456
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not.
Patch / fix
- kb.cert.org/vuls/id/565052 advisory
Exploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- kb.cert.org http://www.kb.cert.org/vuls/id/565052 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
kb.cert.org
/vuls/id/565052
third-party-advisory, exploit, patch, us-government-resource
-
exchange.xforce.ibmcloud.com
/vulnerabilities/6490
vdb-entry
Sources
- CVE List CVE-2001-1476
- NVD CVE-2001-1476
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.