CVE-2023-38408
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
CVSS
9.8
Crítica
EPSS
79.7%
p100
KEV
—
Exploit Today
30
0-100
Publicado: 20 de jul. de 2023 · Última mod.: 15 de out. de 2026 · CWE-428
79.7%EPSS · 30 dias79.7%
2026-10-092026-11-06
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/07/20/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/07/20/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/22/11
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/22/9
- blog.qualys.comhttps://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent
- github.comhttps://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8
- github.comhttps://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d
- github.comhttps://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/08/msg00021.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/
- news.ycombinator.comhttps://news.ycombinator.com/item?id=36790196
- security.gentoo.orghttps://security.gentoo.org/glsa/202307-01
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230803-0010/
- support.apple.comhttps://support.apple.com/kb/HT213940
- www.openssh.comhttps://www.openssh.com/security.html
- www.openssh.comhttps://www.openssh.com/txt/release-9.3p2
- www.qualys.comhttps://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-821557.8 ALT31.9%
——10Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.1dCVE-2026-978606.7 MÉD8.9%
——3YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.8dCVE-2026-153587.5 ALT65.7%
——20ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.44dCVE-2026-814697.8 ALT8.8%
——3Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges43dCVE-2026-572237.0 ALT4.5%
——1Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.39dCVE-2026-778277.1 ALT5.3%
——2Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80.53d