CVE-1999-0248

CRITICAL

A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials.

Affects 1 product across 1 vendor.

CVSS 2.010.0
EPSS1.6%
Percentile76th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 1999. A critical vulnerability affects Ssh systems (CVE-1999-0248). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-1999-GLOBAL-307712-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-1999-0248?
This vulnerability was disclosed in 1999. A critical vulnerability affects Ssh systems (CVE-1999-0248). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-1999-0248?
CVE-1999-0248 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 1.6%.
Is CVE-1999-0248 actively exploited?
No confirmed active exploitation of CVE-1999-0248 as of 2026-06-20.
How do I remediate CVE-1999-0248?
Priority: MEDIUM.
What systems are affected by CVE-1999-0248?
CVE-1999-0248 affects Ssh Ssh.
Vulnerability Details
CVE IDCVE-1999-0248
BSIDBS-1999-GLOBAL-307712-C BreachSpider Global ID
CVSS VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Published1999-01-01
Last Modified2026-06-16
ICS Relevance0%
SourceNVD
Official Description

A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Ssh Ssh 1.2.27
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 10157 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashf680422980b33c0f952d2d8f13fd3cf24b7c49e976f05b1eded4d8801b6d37a394cf43637389a82125717a53c7488af179438cd25ed4f6ac3d24a1933f7318b9
Related CVEs affecting Ssh
CVE-2001-0144 10.0 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to ... CVE-2002-1645 10.0 Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstati... CVE-2012-5975 9.3 The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.... CVE-2024-30170 9.1 PrivX before 34.0 allows data exfiltration and denial of service via the REST... CVE-2021-27891 8.8 SSH Tectia Client and Server before 6.4.19 on Windows have weak key generatio...
View all Ssh CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →