CVE-2012-0920: Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and publ...

Security readout for executives and security teams

This flaw affects Dropbear SSH Server when restricted-command public key access is enabled. An authenticated remote user could send crafted command requests that bypass the intended command restriction and may execute arbitrary code. It matters most on systems that rely on Dropbear to confine automation, backup, support, or partner accounts. Exposure is limited to Dropbear SSH Server 0.52 through 2012.54 with public key authentication and command restrictions enabled. Internet-facing SSH increases reach, but exploitation still requires authentication. Embedded or lightweight Linux deployments using Dropbear should be inventoried. Treat as high priority where Dropbear protects restricted operational accounts. It is not evidenced as actively exploited in the bundle, but the potential impact is severe because authenticated restricted users may escape controls. Mitigation focus: Identify Dropbear versions and configurations using restricted public-key commands.; Apply vendor or distribution updates addressing CVE-2012-0920.; Review Debian DSA-2456 and Dropbear upstream guidance for applicable packages..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.