Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-46446

22
FAUCET Score

CVE-2023-46446, also known as a "Rogue Session Attack," affects AsyncSSH versions prior to 2.14.1, allowing attackers to manipulate SSH client sessions through packet injection/removal and shell emulation. This vulnerability carries a CVSS score of 6.8 (Medium), indicating a network-based attack with high complexity, requiring low privileges, and potentially leading to high confidentiality and integrity impacts. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, including an article on BleepingComputer concerning "Terrapin attacks" which are related to this class of vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.14.1CPE matchmatch criteria
cpe:2.3:a:asyncssh_project:asyncssh:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.8MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.87%
Probability of exploitation in next 30 days
EPSS Percentile
55.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0087 is in the 44th percentile among its peer group of 1,425 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

pippatch availablevia ghsa
Product: asyncsshFixed in: 2.14.1
redhatpatch availablevia redhat_api
Product: Red Hat Ceph Storage 7.1Fixed in: ceph-2:18.2.1-329.el8cp
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ceph Storage 7.1Fixed in: oath-toolkit-0:2.6.12-1.el9cp
View patch
redhatno patchvia redhat_api
Product: Red Hat Ceph Storage 6Fixed in: python-asyncssh

Vendor Advisories (2)

redhatCVE-2023-46446Moderate

python-asyncssh: Rogue Session Attack

Nov 13, 2023
pipGHSA-c35q-ffpf-5qpmhigh

AsyncSSH Rogue Session Attack

Nov 9, 2023

References

lists.debian.org / debian-lts-announce/2024/09/msg00042.html
packetstormsecurity.com / files/176280/Terrapin-SSH-Connection-Weakening.html
github.com / advisories/GHSA-c35q-ffpf-5qpm
github.com / ronf/asyncssh/blob/develop/docs/changes.rst
github.com / ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE
security.netapp.com / advisory/ntap-20231222-0001
terrapin-attack.com