{"id":"CVE-2025-47203","details":"dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.","modified":"2026-08-12T03:51:45.626163255Z","published":"2025-05-07T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47203.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/09/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/12/6"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/13/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/13/10"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/13/3"},{"type":"WEB","url":"https://github.com/mkj/dropbear/blob/master/CHANGES"},{"type":"WEB","url":"https://github.com/mkj/dropbear/blob/master/src/cli-main.c"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00020.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47203.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47203"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mkj/dropbear","events":[{"introduced":"0"},{"fixed":"887241694277b3816da5d174932c10546ea9d2c5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2025.88"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["DROPBEAR_2025.87","DROPBEAR_2024.86","DROPBEAR_2024.85","DROPBEAR_2024.84","DROPBEAR_2022.83","DROPBEAR_2022.82","DROPBEAR_2020.80","DROPBEAR_2020.79","DROPBEAR_2019.78","DROPBEAR_2019.77","DROPBEAR_2018.76","DROPBEAR_2017.75","DROPBEAR_2016.74","DROPBEAR_2016.73","DROPBEAR_2015.71","DROPBEAR_2015.70","DROPBEAR_2015.69","DROPBEAR_2015.68","DROPBEAR_2015.67","DROPBEAR_2014.66","DROPBEAR_2014.65","DROPBEAR_2014.64","DROPBEAR_2014.63","DROPBEAR_2013.62","DROPBEAR_2013.61test","DROPBEAR_2013.60","DROPBEAR_2013.59","DROPBEAR_2013.58","DROPBEAR_2013.57","DROPBEAR_2013.56","DROPBEAR_2012.55","DROPBEAR_2011.54","DROPBEAR_0.53.1","DROPBEAR_0.53","DROPBEAR_0.51","DROPBEAR_0.50","DROPBEAR_0.49","DROPBEAR_0.48","libtomcrypt-1.05"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47203.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}