← Back to Vulnerability Reports CVE Intelligence

CVE-2016-6210

Openbsd Openssh•MEDIUM · CVSS 5.9•No exploitation reported

What is CVE-2016-6210?

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

CVSS5.9 NVD 3.1

SeverityMEDIUM

ExploitationNo exploitation reported

EPSS89% · P100

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWECWE-200

NVD published2017-02-13

NVD last modified2026-06-17

Timeline

2017-02-13Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated
2026-11-06First covered in a defend.network daily briefing

Affected product

Openbsd Openssh

References

Referenced in our briefings & reports

OpenSSH Alpine bypass, refrigeration attacks, critical Linux exploits disclosed (2026-11-06)

Related vulnerabilities

CVE-2026-4020 (same weakness: CWE-200)
CVE-2025-68686 – Fortinet FortiOS (same weakness: CWE-200)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.