Loading
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
Use CWE-200, Openbsd vendor hub and Openssh product page to widen CVE-2016-6210 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2024-6387, CVE-2026-35385 and CVE-2023-51767 for nearby disclosures in the same product family.