Home

Description

A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.

PUBLISHED Reserved 2025-08-05 | Published 2025-08-05 | Updated 2025-11-21 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-248 Uncaught Exception

Product status

Default status
unknown

6.10
affected

Credits

Matt "hostess" Andreko finder

References

www.mattandreko.com/...4/08/sysax-multi-server-6.10-ssh-dos/ exploit

raw.githubusercontent.com/...ows/ssh/sysax_sshd_kexchange.rb exploit

www.mattandreko.com/...4/08/sysax-multi-server-6.10-ssh-dos/ technical-description exploit

raw.githubusercontent.com/...ows/ssh/sysax_sshd_kexchange.rb exploit

www.sysax.com/ product

www.vulncheck.com/...ysax-multi-server-sshd-key-exchange-dos third-party-advisory

cve.org (CVE-2013-10065)

nvd.nist.gov (CVE-2013-10065)

Download JSON