Affected Systems
OpenSSH versions prior to 10.6p2 on Linux systems using musl C library with PAM disabled. Primarily affects Alpine Linux default configurations. Accounts with asterisk (*) password hash are vulnerable. Does not affect glibc-based distributions, Dropbear, non-Linux systems, or PAM-enabled configurations.
Exploitation Status
Active exploitation confirmed. First attempts observed less than 9 hours post-disclosure. Previdian confirmed successful root access on Alpine Linux honeypot. Eight exploitation attempts detected from IP 89.116.89[.]18 (Japan) using oversized passwords and reconnaissance commands.
Business Impact
Unauthenticated attackers can bypass authentication on password-disabled accounts by sending 257-1024 byte passwords, triggering hash failure that matches asterisk placeholder. Grants access with compromised account privileges, potentially exposing deployment credentials, application secrets, and enabling lateral movement. Root-level compromise confirmed on vulnerable Alpine systems. Stems from 2016 patch for CVE-2016-6210.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade to OpenSSH 10.6p2 or apply distribution-specific patches, then restart sshd service on all Alpine Linux and musl-based systems
- Search /var/log/messages for 'Accepted password for' entries involving accounts configured for key-only or no-password access (alpine, root, service accounts)
- Audit all password-disabled accounts (those with asterisk in /etc/shadow) on exposed SSH servers; verify no unauthorized access occurred
- Review doas usage, recently created users, new files, and authorized_keys modifications on internet-facing Alpine systems
- Treat any Alpine Linux system with unexplained 'Accepted password' logs as compromised; initiate incident response and credential rotation