p PatchFirst

CVE-2025-47203

CVE-2025-47203

This page contains facts from public vulnerability sources. Check the original advisory before updating.

dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.

CVSS 4.5 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dropbear ssh

    Versions
    • ≥ 0, < 2025.88: Affected (custom)

    Update to 2025.88

  • dropbear Debian:12

    Versions
    • 2022.83-1
    • 2022.83-1+deb12u1
    • 2022.83-1+deb12u1~bpo11+1
    • 2022.83-1+deb12u2
    Affected ranges
    • ECOSYSTEM: < 2022.83-1+deb12u3

    Update to 2022.83-1+deb12u3

  • dropbear Debian:13

    Affected ranges
    • ECOSYSTEM: < 2025.88-1

    Update to 2025.88-1

  • dropbear Debian:14

    Affected ranges
    • ECOSYSTEM: < 2025.88-1

    Update to 2025.88-1

  • dropbear Ubuntu:16.04:LTS

    Versions
    • 2014.65-1ubuntu2
    • 2015.68-1
    • 2015.70-1
    • 2015.71-1
    • 2016.72-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dropbear Ubuntu:Pro:18.04:LTS

    Versions
    • 2017.75-2
    • 2017.75-3build1
    • 2017.75-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dropbear Ubuntu:Pro:20.04:LTS

    Versions
    • 2019.78-2build1
    • 2019.78-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dropbear Ubuntu:22.04:LTS

    Versions
    • 2020.81-3
    • 2020.81-4
    • 2020.81-5
    • 2020.81-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dropbear Ubuntu:24.04:LTS

    Versions
    • 2022.83-2
    • 2022.83-3
    • 2022.83-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dropbear Ubuntu:25.10

    Versions
    • 2024.86-2
    • 2025.88-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →