CVE-2002-1645

CRITICAL

Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.

Affects 1 product across 1 vendor.

CVSS 2.010.0
EPSS7.9%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2002. A critical vulnerability affects Ssh systems (CVE-2002-1645). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2002-GLOBAL-351612-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2002-1645?
This vulnerability was disclosed in 2002. A critical vulnerability affects Ssh systems (CVE-2002-1645). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2002-1645?
CVE-2002-1645 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 7.9%.
Is CVE-2002-1645 actively exploited?
No confirmed active exploitation of CVE-2002-1645 as of 2026-09-25.
How do I remediate CVE-2002-1645?
Priority: MEDIUM.
What systems are affected by CVE-2002-1645?
CVE-2002-1645 affects Ssh Ssh2.
Vulnerability Details
CVE IDCVE-2002-1645
BSIDBS-2002-GLOBAL-351612-C BreachSpider Global ID
CVSS VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Published2002-11-25
Last Modified2026-06-16
ICS Relevance0%
SourceNVD
Official Description

Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Ssh Ssh2 3.1 3.1.1 3.1.2 3.1.3 3.1.4 3.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 8733 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash8264fa8ea15300c58f5faba62e56d80764e8cc0f195481bf479181174bf609b546cca7eb8d4bb725f42a1a54a4d4b9765dd6f7439a3fa4604dca619bca80cd0a
Related CVEs affecting Ssh
CVE-1999-0248 10.0 A race condition in the authentication agent mechanism of sshd 1.2.17 allows ... CVE-2001-0144 10.0 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to ... CVE-2012-5975 9.3 The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.... CVE-2024-30170 9.1 PrivX before 34.0 allows data exfiltration and denial of service via the REST... CVE-2021-27891 8.8 SSH Tectia Client and Server before 6.4.19 on Windows have weak key generatio...
View all Ssh CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →