Dropbear SSH vulnerabilities in embedded firmware: identify, prioritise and fix

Dropbear is a small SSH server and client (dropbear, dbclient, dropbearkey, dropbearconvert and scp) that is often built as a single dropbearmulti binary, which makes it a common choice for routers, gateways, cameras and industrial controllers where OpenSSH is too large. It ships with build systems such as Buildroot and Yocto, which our embedded Linux build systems and SBOM guide covers, and it usually sits next to BusyBox in the same root filesystem (see BusyBox vulnerabilities in embedded Linux firmware for that half of the image).

Two properties shape how its CVEs behave in firmware. First, almost every feature is a compile-time switch. Dropbear's own default_options.h says it "documents compile-time options, and provides default values", and that local customisation goes into localoptions.h, so two devices running the same Dropbear version can have different ciphers, key exchange methods and forwarding features. Second, device makers often pin one Dropbear version for years, so a fleet in the field can carry CVEs that were fixed upstream long ago.

The project's CHANGES file is the primary record: each release lists its security fixes, usually with the CVE ID. The table below pulls the ones most likely to show up in a firmware scan. Scores are NVD's unless marked; EPSS values are from FIRST's 2026-11-09 dataset, and none of these CVEs was in CISA's KEV catalog as of its 2026.11.09 release.

The CHANGES file also lists 2026 server fixes that may not have a CVE ID: 2026.90 closes a bypass of an authorized_keys forced command when Dropbear runs with -t, and 2026.93 fixes a use-after-free in X11 forwarding, which is off by default (DROPBEAR_X11FWD 0). The latest release on 2026-11-10 is 2026.94 (23 July 2026).

The Terrapin paper site describes it as a prefix truncation attack: "by carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it." It needs an attacker who can intercept and modify traffic on the network path, and a connection secured with ChaCha20-Poly1305 or a CBC cipher with Encrypt-then-MAC.

For Dropbear the scope is narrower than for OpenSSH. Dropbear's 2024.84 release notes say "chacha20-poly1305 is the only affected cipher," and that the flaw "does not seem to reduce Dropbear's security," because the only packet affected would be the server-sig-algs extension, used for compatibility. The Debian security tracker entry marks Debian's older buster package not affected because ChaCha20-Poly1305 support only arrived in 2020.79, and lists the backported fixes as 2020.81-3+deb11u1 (bullseye) and 2022.83-1+deb12u1 (bookworm).

The 0.935 EPSS score looks alarming, but the CVE record covers OpenSSH and dozens of other SSH implementations, so the score is not specific to Dropbear. Use the Dropbear-specific facts above to rank it, which usually places Terrapin below an unpatched memory-safety bug on the same device.

Order the matches by what is compiled in and reachable, then by public exploitation data. Our KEV and EPSS prioritisation guide covers how those scores work.

• First: pre-authentication memory bugs on old versions (CVE-2016-7406 before 2016.74) and post-authentication root code execution (CVE-2017-9078 before 2017.75) where the SSH port is reachable from a network you do not control.
• Next: CVE-2025-14282 on 2024.84 to 2025.88 if more than one account can log in. The 2025.89 notes say it allowed "root privilege escalation" through programs that authenticate unix sockets by peer credentials.
• Then: Terrapin, if chacha20-poly1305 is built in and the SSH service is exposed beyond a trusted management network.
• Context-dependent: client-side CVEs (CVE-2021-36369, CVE-2025-47203) only matter if the device itself runs dbclient, for example in a tunnel or backup script.

Exposure changes the order more than scores do. A Dropbear server bound to a management VLAN only, with password logins off, sits in a very different place from one listening on the WAN interface with a factory default password; our hard-coded credentials guide covers that second failure.

SoftWSP's automated scan unpacks a firmware image, identifies Dropbear and the other software components in the file system together with their versions (the same component inventory our firmware SBOM guide describes), and matches each version against CVE records, CISA's KEV catalog and FIRST's EPSS scores. That matching is deterministic: code produces the component, version and CVE list, and the scores come from NVD, KEV and EPSS.

AI's part is the written explanation on top of that matching. It summarises which Dropbear CVEs matched, which are KEV-listed or have a high EPSS score, and what the version evidence was, and every sentence cites the component, version and record it relies on. An engineer reviews every finding before the report is delivered. The judgements this guide describes as manual stay with that engineer: which algorithms and forwarding features the build compiled in, whether the SSH port is reachable, and whether a vendor backport already closes a version-matched CVE. A Debian-style 2022.83 package with backports still matches CVE-2025-47203 on version alone, and the review step is where that becomes a documented "fixed" decision instead of a guess.

For where SSH service review fits in a full assessment, see the OWASP Firmware Security Testing Methodology guide, or device & firmware security services to have a specific image reviewed.

This guide draws on Dropbear's CHANGES file, default_options.h, sysoptions.h and server option help, the Terrapin paper site, the Debian Security Tracker, NVD, CISA's KEV catalog (version 2026.11.09) and FIRST EPSS data dated 2026-11-09, all read directly on 2026-11-10.