CVE-2001-1476: SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for r...

Security readout for executives and security teams

This is an old SSH password-disclosure weakness. Under a specific legacy setup using RC4 encryption and a NULL-password blocking option, a remote attacker could learn whether parts of a password guess were correct by replaying modified sessions and observing different responses. Exposure is most likely limited to legacy SSH deployments older than 2.0 that still allow RC4 and match the described authentication option. Modern SSH services are unlikely to be affected, but the provided data does not identify specific vendors or products. Moderate priority for most environments unless legacy SSH is present. Treat as a targeted legacy-risk cleanup item, not an emergency, because affected products, severity, fixes, and exploitation evidence are incomplete in the provided sources. Mitigation focus: Inventory SSH services and identify any software older than 2.0.; Disable RC4 for SSH where vendor-supported and operationally safe.; Retire or upgrade legacy SSH implementations following vendor guidance..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.