CVE-2024-6387

CRITICALNVD 8.19.0▲Weaponized

9.0EG

EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.

4,205 internet-facing services (distinct ip:port) on record running an affected version — derived from Shodan data (© Shodan); a patched service can stay counted while its port stays open
High exploitation likelihood — EPSS 100%
Public exploit code is available (ssvc poc, epss top5pct, epss high, public exploit)

CISA-KEV: Not listedEPSS PROB: 100%CVSS: 8.1Exploit: ssvc poc · epss top5pct · epss high · public exploitExposed services: 4,205

A fix is available — apply it.

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Internet exposure · derived from Shodan data

4,205 internet-facing services (distinct ip:port) on record running a version that maps to CVE-2024-6387, in our KEV-Exposure radar’s Shodan-derived sample.

across 83 countries (United States, Germany, China, France, United Kingdom)top: openssh

See the KEV-Exposure radar →Derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. Aggregate, host-redacted.

How it counts: every 12 hours, when Shodan query credits allow, the radar runs one Shodan query per tracked product, reads up to 100 ip:port services per query, and keeps a service when its banner version matches a CISA-KEV or high-EPSS CVE; a service is dropped when neither a search nor a Shodan InternetDB port re-check has refreshed it for 21 days. A re-check that finds the port still listed by Shodan InternetDB refreshes the service without re-reading the banner, so a patched service can stay counted while its port stays open. A count is a banner-version inference over a sample, not an exploit test and not an internet-wide census, and the unit is a service, not a machine: a machine answering on two ports counts twice.

CVSS v3: 8.1
EG Score: 9.0CRITICALhigh confidence
EG Risk: 80
EPSS PROB: 100%
EPSS %ILE: 99th
KEV: Not listed

CISA SSVCTrack at low, Track* at medium and Attend at high mission impact.

A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.

Exploitation public PoC (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact total (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table

Published

July 1, 2024

Last Modified

September 1, 2026

Advisory Details (10)

Auto-updated May 12, 2026

🔬 Proof of concept available. Patch available. Sources: redhat.

generic🟡 PoC Available