Skip to content
Fencer Vulns
critical 9.1

CVE-2018-10933 in the critical feed json

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.

published 2018-10-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2986

cvss
9.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
91.8%
EPSS 91.8% chance of exploitation in 30 days, percentile 99.8%
public exploits
3
Metasploit, Exploit-DB

Summary

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Patch / fix

  • libssh libssh 0.7.6, 0.8.4
  • libssh Debian 14, Debian 13, Debian 12 0.8.4-1

debian advisories DEBIAN-CVE-2018-10933

  • libssh Ubuntu 14.04 LTS 0.6.1-0ubuntu3.4
  • libssh Ubuntu 16.04 LTS 0.6.3-4.3ubuntu0.1
  • libssh Ubuntu 18.04 LTS 0.8.0~20170825.94fa1e38-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2018-10933

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cockpit RHEL 7 EXTRAS_OTHER 176-4.el7
  • libssh RHEL 7 EXTRAS_OTHER 0.7.1-7.el7
  • cockpit-pcp RHEL 7 EXTRAS_OTHER 176-4.el7
  • cockpit-docker RHEL 7 EXTRAS_OTHER 176-4.el7
  • cockpit-machines RHEL 7 EXTRAS_OTHER 176-4.el7
  • cockpit-storaged RHEL 7 EXTRAS_OTHER 176-4.el7
  • cockpit-dashboard RHEL 7 EXTRAS_OTHER 176-4.el7
  • cockpit-packagekit RHEL 7 EXTRAS_OTHER 176-4.el7

red hat advisories RHBA-2018:3712

  • libssh SLED 12 SP3, SLE Workstation Extension 12 SP3, SLE Software Development Kit 12 SP3 0.6.3-12.6.1
  • libssh SLE Module for Basesystem 15 0.7.5-6.3.1

suse advisories SUSE-SU-2018:3253-1SUSE-SU-2018:3162-1

  • libssh openSUSE Tumbleweed 0.9.6-1.2

opensuse advisories openSUSE-SU-2024:10998-1

  • libssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +17 more 0.7.6-r0

alpine advisories ALPINE-CVE-2018-10933

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libssh Arch Linux 0.8.4-1

arch linux advisories AVG-780

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10933 updated cvss 9.1

libssh: Authentication Bypass due to improper message callbacks implementation

  • Red Hat Enterprise Linux 7 Extras cockpit 176-4.el7, libssh 0.7.1-7.el7, cockpit-pcp 176-4.el7, cockpit-docker 176-4.el7, cockpit-machines 176-4.el7, cockpit-storaged 176-4.el7, +2 more
    fixed: vendor fix RHBA-2018:3712
  • Red Hat Enterprise Linux 6 libssh2 Red Hat Enterprise Linux 7 libssh2 Red Hat Enterprise Linux 8 libssh, libssh2, libssh-config
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-007-01 updated cvss 9.1

Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer

  • Hitachi Energy FOX61x R1 using CESM1/CESM2 < cesne_r1h07_12.esw Hitachi Energy FOX61x R2 using CESM1/CESM2 < cesne_r2d14_03.esw
    affected: mitigation “Hitachi ABB Power Grids recommends users apply the following firmware: FOX61x R1: CESM1/CESM2: Update to Version cesne_r1h07_12.esw or newer” hitachiabb-powergrids.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-20-294-02 updated cvss 9.1

Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer

  • Hitachi Energy XMC20 R4 using COGE5 <co5ne_r1h07_12.esw Hitachi Energy XMC20 R6 using COGE5 < co5ne_r2d14_03.esw
    affected: mitigation “Hitachi ABB Power Grids has corrected the problem in the following product versions and recommends users apply the firmware update at the earliest availability” hitachiabb-powergrids.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/ssh/libssh_auth_bypass)
  2. Published

Exploit prediction

91.79% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.0 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.0 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • [UNKNOWN] libssh

Classification

Weakness
  • CWE-592 DEPRECATED: Authentication Bypass Issues
  • CWE-287 Improper Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.