Dropbear 2025.89 Unix Domain Socket improper authentication

Summaryinfo

A vulnerability classified as critical was found in Dropbear 2025.89. This affects an unknown function of the component Unix Domain Socket Handler. Such manipulation leads to improper authentication. This vulnerability is listed as CVE-2025-14282. The attack must be carried out locally. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Dropbear 2025.89 and classified as critical. Affected by this issue is an unknown function of the component Unix Domain Socket Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the remote client as root, only switching to the logged-in user upon spawning a shell or performing some operations like reading the user's files. With the recent ability of also using unix domain sockets as the forwarding destination any user able to log in via ssh can connect to any unix socket with the root's credentials, bypassing both file system restrictions and any SO_PEERCRED / SO_PASSCRED checks performed by the peer.

The advisory is available at seclists.org. This vulnerability is handled as CVE-2025-14282. The exploitation is known to be difficult. Local access is required to approach this attack. Technical details are unknown but a public exploit is available.

The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 279441 (Debian dsa-6086 : dropbear - security update), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (279441). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• SSH Server Software

Name

• Dropbear

Version

• 2025.89

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion