Analyst readout for executives and security teams
Plain-English summary
This issue is a risky default-configuration scenario in OpenSSH. If SSH is paired with anonymous or limited-access services such as AnonCVS, authenticated remote users may be able to use TCP forwarding to reach unintended network services. The bundle does not show active exploitation or a vendor patch.
Executive priority
Treat as a targeted configuration risk, not an internet-wide emergency. Prioritize review if legacy source-code access, anonymous SSH workflows, or sensitive internal services share trust boundaries with SSH servers.
Technical view
CVE-2004-1653 describes OpenSSH default AllowTcpForwarding behavior enabling a port-bounce condition for remote authenticated users in deployments using anonymous access programs. Impact depends on SSH configuration and reachable internal services. No CVSS, CWE, affected version range, or concrete patch is provided in the source bundle.
Likely exposure
Exposure is most likely on older or legacy SSH deployments that allow anonymous or constrained authenticated access, especially AnonCVS-style accounts, while leaving TCP forwarding enabled.
Exploitation context
The source bundle indicates remote authenticated access is required. CISA KEV is false, and the provided sources do not establish active exploitation. Practical risk depends on account restrictions and network reachability from the SSH server.
Researcher notes
Evidence is sparse and old. The CVE record identifies the risky default and AnonCVS context but does not provide affected versions, scoring, or patch details. Validate configuration and trust-boundary assumptions before assigning urgency.
Mitigation direction
- Review vendor guidance for supported OpenSSH configuration recommendations.
- Disable or restrict TCP forwarding for anonymous or constrained SSH accounts where unnecessary.
- Separate anonymous access programs from networks containing sensitive services.
- Retire or modernize legacy AnonCVS-style access paths where feasible.
Validation and detection
- Inventory SSH servers that support anonymous or limited authenticated access.
- Review sshd policy for AllowTcpForwarding on those accounts.
- Confirm account restrictions prevent unintended forwarding to internal services.
- Check SSH logs for unusual forwarding activity from constrained accounts.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2004-1653 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 20040831 SSHD / AnonCVS NastynessCVE reference · mailing-list, x_refsource_BUGTRAQ
- openssh-port-bounce(17213)CVE reference · vdb-entry, x_refsource_XF
- 1011143CVE reference · vdb-entry, x_refsource_SECTRACK
- 9562CVE reference · vdb-entry, x_refsource_OSVDB
- https://security.netapp.com/advisory/ntap-20191107-0001/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.