iOSOperating system · Cisco
CVE-2002-1358
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedMultiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceMultiple SSH2 server and client implementations fail to properly validate or sanitize list elements that contain empty strings or are empty themselves. When processing malformed list data during SSH protocol communication, the software may dereference null pointers or overflow buffers, leading to denial of service or potential arbitrary code execution by remote attackers.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
iOSOperating system
= 12.0s= 12.0st= 12.1e= 12.1ea= 12.1t= 12.2= 12.2s= 12.2t= 1.0a_for_windows= 5.4.1= 3.4.6= 2.0= 0.48= 0.49= 0.53= 2.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Authentication
- None
- Confidentiality
- Complete
- Integrity
- Complete
- Availability
- Complete
AV:N/AC:L/Au:N/C:C/I:C/A:C
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the SSH client or server product name and versionLocate the SSH software in use (e.g., PuTTY, WinSCP, Cisco iOS, etc.) and determine its exact version number by checking the application properties, about dialog, or running 'version' command if available via CLIAffected if The product name matches any of: PuTTY, WinSCP, Cisco iOS, Fissh Ssh Client, Intersoft Securenetterm, Netcomposite Shellguard Ssh, or Pragma Systems Secureshell AND the version matches exactly one listed in the affected versions
-
Verify PuTTY versionOpen PuTTY and check 'About PuTTY' from the system menu, or check the executable file properties of putty.exeAffected if Version is 0.48, 0.49, or 0.53
-
Verify WinSCP versionOpen WinSCP and go to Help > About, or check the program files directory for version informationAffected if Version is exactly 2.0.0
-
Verify Cisco iOS versionExecute 'show version' command on the Cisco device via console or remote managementAffected if Version string contains: 12.0s, 12.0st, 12.1e, 12.1ea, 12.1t, 12.2, 12.2s, or 12.2t
-
Check for legacy SSH implementationsAudit installed software on Windows systems for presence of: Pragma Systems Secureshell 2.0, Fissh Ssh Client 1.0a, Intersoft Securenetterm 5.4.1, or Netcomposite Shellguard Ssh 3.4.6Affected if Any of these specific products and versions are installed
The environment is affected if any SSH client or server matching the listed product names and exact versions is in use, since the vulnerability exists in those specific builds due to improper validation of empty list elements during SSH protocol communication.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpdate all SSH2 server and client implementations to vendor-provided patches; legacy systems should be upgraded to current SSH versions that include proper input validation for list processing.
Upgrade to current stable versions of respective SSH clients (PuTTY 0.80+, WinSCP 6.x, or use modern alternatives like OpenSSH)
- Identify all affected SSH client installations in your environment
- For PuTTY: Uninstall versions 0.48, 0.49, or 0.53 and install the latest stable PuTTY release from official sources (https://www.chiark.greenend.org.uk/~sgtatham/putty/)
- For WinSCP: Uninstall version 2.0.0 and install the latest stable WinSCP release from official sources (https://winscp.net/)
- For SecureNetterm, Shellguard SSH, SecureShell, and other listed products: These are legacy/unmaintained products; replace with actively maintained SSH client alternatives such as OpenSSH, PuTTY, or Bitvise SSH Client
- Verify that the new versions are properly installed and functioning
- Remove or disable any remaining installations of the affected versions
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in iOS
Scoped from the published advisory
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2002-1358 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2002-1358 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data