CVE-2003-0190: OpenSSH PAM username enumeration via timing discrepancy

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw only discloses valid usernames, but it is remotely reachable without authentication, has a very high EPSS score, and public exploit material is referenced.

What it is

OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled returns an error immediately when a username does not exist, while valid usernames take longer to process. This observable timing difference lets a remote attacker distinguish valid accounts from invalid ones. It matters because confirmed usernames feed credential attacks and reduce guesswork.

Impact

An attacker gains a list of valid usernames on the target host. No code execution, data modification, or privilege escalation is provided by this flaw itself.

Attack surface

Reachable over the network through the SSH service (AV:N, AC:L, Au:N per the CVSS 2.0 vector), requiring no authentication and no user interaction. Only deployments with PAM support enabled are affected.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is 0.76751 (99.5th percentile) and one reference carries an Exploit tag, indicating public exploit material exists.

What to do

• Upgrade OpenSSH-portable past 3.6.1p1 to a release that does not leak timing differences with PAM enabled; apply the vendor patches referenced in the advisories.
• If immediate upgrade is not possible, disable PAM support in sshd where operationally feasible, or restrict SSH exposure to trusted networks.
• Enforce key-based authentication and disable password authentication to reduce the value of enumerated usernames.
• Apply rate limiting and connection throttling on the SSH service to make repeated timing probes harder to run.
• Review Siemens SCALANCE X204RNA firmware advisories for the affected product line and apply the vendor fix.

Detection

• Monitor SSH authentication logs for repeated failed logins across many distinct usernames from a single source, which is consistent with enumeration.
• Baseline and alert on high volumes of short-lived SSH connections from one host over a short window.
• Correlate SSH source IPs against threat intelligence and block sources that probe many usernames without successful authentication.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.