CVE-2023-51385

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

• ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

19.75% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 97.2% of scored records. A rank, not a probability.

NVD base score

6.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2023-12-18 00:00Z2 YR AGO

Last updated

2026-07-14 12:33Z1 MO AGO

Reserved

2023-12-18

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Base

Data version

5.2

Document digest

e34f3ed8b58e84b2d1d7c31e7966dfce7698ac821954ac9e2316483d9a1c9990

• www.openssh.comhttps://www.openssh.com/txt/release-9.6
• www.openwall.comhttps://www.openwall.com/lists/oss-security/2023/12/18/2
• github.comhttps://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
• www.debian.orgDSA-5586https://www.debian.org/security/2023/dsa-5586vendor-advisory
• vin01.github.iohttps://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
• lists.debian.org[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security updatehttps://lists.debian.org/debian-lts-announce/2023/12/msg00017.htmlmailing-list
• www.openwall.com[oss-security] 20231226 CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handlinghttp://www.openwall.com/lists/oss-security/2023/12/26/4mailing-list
• security.gentoo.orgGLSA-202312-17https://security.gentoo.org/glsa/202312-17vendor-advisory
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20240105-0005/
• support.apple.comhttps://support.apple.com/kb/HT214084
• seclists.org20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4http://seclists.org/fulldisclosure/2024/Mar/21mailing-list
• www.openwall.comhttp://www.openwall.com/lists/oss-security/2025/10/07/1
• www.openwall.comhttp://www.openwall.com/lists/oss-security/2025/10/12/1
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-794697.html
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-769027.html
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html