Back

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

Published: Dec 31, 2003 Modified: Jun 16, 2026
CWE-362

CVSS Metrics

Affected Products (45)

Vendor Product Version
openbsd openssh 1.2
openbsd openssh 1.2.1
openbsd openssh 1.2.2
openbsd openssh 1.2.3
openbsd openssh 1.2.27
openbsd openssh 1.3
openbsd openssh 1.5
openbsd openssh 1.5.7
openbsd openssh 1.5.8
openbsd openssh 2
openbsd openssh 2.1
openbsd openssh 2.1.1
openbsd openssh 2.2
openbsd openssh 2.3
openbsd openssh 2.3.1
openbsd openssh 2.5
openbsd openssh 2.5.1
openbsd openssh 2.5.2
openbsd openssh 2.9
openbsd openssh 2.9.9

…and 25 more

GitHub Security Advisory GHSA-49wx-627v-6mcq

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard...

References (12)

Risk Scores

CVSS Score 7.6 / 10
EPSS Score 5.57%

Top 8% most likely to be exploited

Threat Score 32.1 / 100

Data Sources

NVD EPSS GitHub