PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7409 Dropbear SSH Project CVE debrief

CVE-2016-7409 is a local information-disclosure issue in Dropbear SSH. On affected versions before 2016.74, dbclient and server builds compiled with DEBUG_TRACE can let a local user read process memory via the -v argument, in a path related to a failed remote ident. The NVD record classifies it as CWE-200 with CVSS 5.5 (medium), reflecting that the issue requires local access and affects confidentiality rather than integrity or availability.

Vendor
Dropbear SSH Project
Product
CVE-2016-7409
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Administrators, product teams, and embedded-system integrators using Dropbear SSH dbclient or server builds, especially if DEBUG_TRACE is enabled in production or release builds. Systems with local user access are the primary concern.

Technical summary

The vulnerability affects Dropbear SSH versions through 2016.73. According to the NVD description, when compiled with DEBUG_TRACE, the dbclient and server components can expose process memory to local users through the -v argument after a failed remote ident path. NVD assigns CWE-200 and the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a local, confidentiality-focused leak.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade Dropbear SSH to 2016.74 or later.
  • Ensure production and release builds are not compiled with DEBUG_TRACE.
  • Audit deployed packages, firmware, and appliances for Dropbear versions 2016.73 and earlier.
  • Limit local shell or account access on systems where affected builds cannot be removed immediately.
  • Verify that any diagnostic or debug configuration used during testing is not present in shipped binaries.

Evidence notes

The public NVD description states that Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident. NVD also lists the vulnerable version range as ending in 2016.73, the weakness as CWE-200, and the CVSS vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The supplied reference set includes an oss-security mailing list post dated 2016-09-15, a Dropbear revision/pach reference, and a Gentoo advisory, which together support that the issue and fix were publicly tracked before CVE publication on 2017-03-03.

Official resources

The CVE record was published on 2017-03-03. The supplied references include a 2016-09-15 mailing list discussion and patch reference, indicating the issue was publicly tracked before CVE publication.