Skip to content
Fencer Vulns
high 7.5

CVE-2002-1059 in the critical feed json

Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code vi…

published 2002-10-04 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1048

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
60.3%
EPSS 60.3% chance of exploitation in 30 days, percentile 99.1%
public exploits
4
Metasploit, Exploit-DB

Summary

Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/windows/ssh/securecrt_ssh1)
  2. Published

Exploit prediction

60.30% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/ssh/securecrt_ssh1 SecureCRT SSH1 Buffer Overflow metasploit exploit, average rank, 2002-07-23
  • EDB-21635 SecureCRT 2.4/3.x/4.0 - SSH1 Identifier String Buffer Overflow (2) remote, 2002-07-23
  • EDB-21634 SecureCRT 2.4/3.x/4.0 - SSH1 Identifier String Buffer Overflow (1) dos, 2002-07-23
  • EDB-16460 SecureCRT 4.0 Beta 2 SSH1 - Remote Buffer Overflow (Metasploit) remote, 2010-04-30
  • securityfocus.com http://www.securityfocus.com/bid/5287 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.