CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

View graph Watch Export

CVSS v3.1

5.3 MEDIUM

EPSS

98.6%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityLOW

IntegrityNONE

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Timeline

disclosure → media coverage

Aug 17, 2018

Disclosure — published as a CVE record. · last revised by NVD Dec 17, 2025

Public PoC (10)

github.com/trimstray/massh-enum github.com/gbonacini/opensshenum github.com/Rhynorater/CVE-2018-15473-Exploit github.com/epi052/cve-2018-15473 github.com/pyperanger/CVE-2018-15473_exploit github.com/r3dxpl0it/CVE-2018-15473 github.com/JoeBlackSecurity/SSHUsernameBruter-SSHUB github.com/cved-sources/cve-2018-15473 github.com/LINYIKAI/CVE-2018-15473-exp github.com/trickster1103/-

Unverified third-party code — review before executing.