CVE-2025-47203: Dropbear SSH dbclient Command Injection via Untrusted Multihop Hostname

CVE-2025-47203 is a command injection vulnerability in dbclient, the SSH client component of Dropbear SSH, a compact SSH implementation that embedded Linux devices, routers and other firmware commonly ship instead of the larger OpenSSH client: dbclient's multihop feature builds a shell command from a comma-separated hostname argument and runs it through a shell, so a hostname string that an attacker can influence, for example one passed through from another program or script, can smuggle in shell metacharacters and execute arbitrary local commands. NVD's own severity analysis is still pending for this CVE, so this page is not indexed yet; the secondary score shown below comes from the issue's reporting CNA, not from NVD.

CVE-2025-47203 (CWE-78, OS command injection) affects dbclient, the lightweight SSH client bundled with Dropbear SSH. NVD's description states: "dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used" (NVD).

Dropbear is maintained as a small-footprint alternative to OpenSSH and is widely built into router, embedded-Linux and IoT firmware images where code size matters. The vulnerable code path is dbclient's multihop proxy feature, which lets a user chain SSH connections through intermediate hosts by separating hostnames with commas; a Debian LTS security advisory describing the issue states plainly: "dbclient(1) hostname arguments with a comma (for multihop) are passed to the shell which could result in running arbitrary shell commands locally" (Debian LTS security advisory).

As of 2026-11-07, NVD records the CVE with status "Deferred" and has not published its own Primary CVSS score; the one score on file is a Secondary CVSS v3.1 base score of 4.5 (medium), vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, submitted by the reporting CNA — not an NVD-confirmed assessment (NVD).

Upstream Dropbear fixed the issue by changing how multihop connections are established. The fixing commit's message is direct about the mechanism: "Execute multihop commands directly, no shell. This avoids problems with shell escaping if arguments contain special characters" (Dropbear commit e5a0ef27c2). The fix shipped in upstream Dropbear 2025.88, and Debian backported it to the bullseye (11) branch as 2020.81-3+deb11u3 (Debian LTS security advisory).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00589 (48.3rd percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, any device or script that invokes dbclient's multihop syntax with a hostname string derived from untrusted input, such as a value from a configuration file supplied by another party or a network-facing management interface, should be updated to Dropbear 2025.88 or later, or should avoid passing untrusted data into that hostname argument.

• dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument because a shell is used (CWE-78). — NVD
• dbclient hostname arguments containing a comma (used for multihop) are passed to the shell, which could result in running arbitrary shell commands locally; fixed in Debian bullseye as 2020.81-3+deb11u3. — Debian LTS security advisory
• NVD status "Deferred" as of 2026-11-07, no NVD-published Primary score; the only score on file is a Secondary CVSS v3.1 4.5 (medium) from the reporting CNA. — NVD
• Fix executes multihop commands directly instead of through a shell, specifically to avoid shell-escaping problems with special characters in arguments; fix released upstream as Dropbear 2025.88. — Dropbear commit e5a0ef27c2
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00589 (48.3rd percentile) as of 2026-11-06. — FIRST EPSS