Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2016-6210

MediumPublic exploit

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large…

Published Feb 13, 2017 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2016-6210, DEBIAN-CVE-2016-6210, DLA-578-1, DSA-3626-1, SUSE-SU-2016:2280-1, SUSE-SU-2016:2281-1, UBUNTU-CVE-2016-6210, USN-3061-1

Key Facts

Patch immediately
  • CVE-2016-6210 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Openssh (Openbsd), rootio-openssh, openssh-cavs (amazon) and 13 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 89% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Openssh 7.2, Openssh 0:5.3p1-123.el6_9, Openssh 0:7.4p1-11.el7.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

89%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2016-6210 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

Affected Products

130 affected entries in total
ProductAffected versionsFixed in
OpensshOpenbsdSee advisory7.2
rootio-opensshrootioSee advisory1:7.2p2-6
openssh-cavsamazonSee advisory7.4p1-11.68.amzn1
openssh-clientsamazonSee advisory7.4p1-11.68.amzn1
openssh-keycatamazonSee advisory7.4p1-11.68.amzn1
11 more affected products in the full CVE brief

Patched Releases

Openssh

7.2, 0:5.3p1-123.el6_9, 0:7.4p1-11.el7, 1:6.0p1-4+deb7u5, 1:6.6p1-2ubuntu2.8, 1:6.7p1-5+deb8u3, 1:7.2p2-4ubuntu2.1, 1:7.2p2-6, 5.3p1-123.el6_9, 5.3p1-124.0.2.el6_10, 5.3p1-124.el6_10+sp999, 6.2p2-0.33.2, 6.6p1-14.1, 6.6p1-28.1, 6.6p1-52.1, 6.8_p1-r7, 7.2_p2-r1, 7.2p2-3.1, 7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-askpass

5.3p1-123.el6_9, 5.3p1-124.0.2.el6_10, 6.2p2-0.33.2, 7.4p1-11.el7

openssh-askpass-gnome

6.2p2-0.33.5, 6.6p1-14.1, 6.6p1-28.2, 6.6p1-52.1

openssh-cavs

6.6p1-14.1, 7.2p2-3.1, 7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-clients

5.3p1-123.el6_9, 5.3p1-124.0.2.el6_10, 7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-fips

6.6p1-14.1, 6.6p1-28.1, 6.6p1-52.1, 7.2p2-3.1

openssh-helpers

6.6p1-14.1, 6.6p1-28.1, 6.6p1-52.1, 7.2p2-3.1

openssh-keycat

7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-ldap

5.3p1-123.el6_9, 5.3p1-124.0.2.el6_10, 7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-openssl1

6.6p1-15.1

openssh-openssl1-helpers

6.6p1-15.1

openssh-server

5.3p1-123.el6_9, 5.3p1-124.0.2.el6_10, 7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-server-sysvinit

7.4p1-11.el7

pam_ssh_agent_auth

0.10.3-1.11.68.amzn1, 0.10.3-1.11.el7, 0.9.3-123.el6_9, 0.9.3-124.0.2.el6_10

rootio-openssh

1:7.2p2-6

seal-openssh

5.3p1-124.el6_10+sp999

Timeline

  1. Publicly disclosed

    Feb 13, 2017

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-385 Covert Timing Channel

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2016-6210 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo