CVE-2018-15473: OpenSSH user enumeration via auth timing discrepancy

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.3) and it only leaks usernames, but near-maximum EPSS and public exploits make it a common reconnaissance step worth prompt patching.

What it is

OpenSSH through 7.7 fails to delay the bailout for an invalid authenticating user until after the request packet is fully parsed, creating a timing and response discrepancy in auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. This lets a remote client distinguish valid usernames from invalid ones. It matters because confirmed account names feed credential attacks and targeted follow-on exploitation.

Impact

An attacker gains a reliable list of valid local usernames on the SSH service. No code execution, data access, or privilege escalation is provided by this flaw alone.

Attack surface

Reachable over the network against the SSH daemon (CVSS AV:N, PR:N, UI:N); no authentication or user interaction is required, as the enumeration occurs during the authentication exchange itself.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.986 probability, 0.999 percentile) and multiple public Exploit-DB entries exist, so exploitation is practical and widely available.

What to do

• Upgrade OpenSSH to a version after 7.7 that includes the upstream fix commit 779974d35b4859c07bc3cb8a12c74b43b0a7d1e0, or apply the vendor backport (Debian DSA-4280, Ubuntu USN-3809-1, Red Hat RHSA-2019:0711/2143, Gentoo GLSA 201810-03).
• Patch downstream products embedding OpenSSH, including NetApp, Oracle, and Siemens advisories listed in the references.
• Restrict SSH exposure to trusted networks or jump hosts and enforce rate limiting on authentication attempts.
• Disable unused authentication methods (GSSAPI, hostbased) where they are not required.
• Enforce key-based authentication and strong account naming practices to reduce the value of enumerated usernames.

Detection

• Alert on high volumes of SSH authentication failures from a single source, especially with varied usernames, indicating enumeration scanning.
• Monitor for the public Exploit-DB PoC traffic patterns (45210, 45233, 45939) against sshd.
• Baseline and detect timing or response-size differences between valid and invalid username authentication attempts.
• Correlate SSH username probing with subsequent credential-stuffing or brute-force activity from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.