{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1021.004 SSH","home_page_url":"https://patchfirst.co/technique/T1021.004/","feed_url":"https://patchfirst.co/feed/technique/T1021.004.json","description":"New and newly exploited CVEs that lead to ATT&CK T1021.004 SSH, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2015-7755#kev","url":"https://patchfirst.co/cve/CVE-2015-7755/","title":"[KEV] CVE-2015-7755: Juniper ScreenOS Improper Authentication Vulnerability","content_text":"Juniper · ScreenOS. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 61.1% (higher than 99.16% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1021.004 SSH. Priority 69.7 of 100.","summary":"Juniper ScreenOS Improper Authentication Vulnerability","date_published":"2025-10-02T00:00:00.000Z","date_modified":"2026-06-17T00:33:04.000Z","tags":["kev","public-exploit","T1078","T1021.004"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2025-10-02","ransomware":false},"epss":{"score":0.61139,"percentile":0.99159},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Juniper","product":"ScreenOS","techniqueIds":["T1078","T1021.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32433#kev","url":"https://patchfirst.co/cve/CVE-2025-32433/","title":"[KEV] CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","content_text":"Erlang · Erlang/OTP. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 98.9% (higher than 99.93% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1021.004 SSH; T1059 Command and Scripting Interpreter. Priority 80.0 of 100.","summary":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","date_published":"2025-06-09T00:00:00.000Z","date_modified":"2026-06-17T09:11:59.000Z","tags":["kev","public-exploit","T1021.004","T1059"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2025-06-09","ransomware":false},"epss":{"score":0.98924,"percentile":0.99928},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Erlang","product":"Erlang/OTP","techniqueIds":["T1021.004","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-39780#kev","url":"https://patchfirst.co/cve/CVE-2023-39780/","title":"[KEV] CVE-2023-39780: ASUS RT-AX55 Routers OS Command Injection Vulnerability","content_text":"ASUS · RT-AX55 Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 39.5% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1588 Obtain Capabilities; T1059.004 Unix Shell; T1021.004 SSH. Priority 68.9 of 100.","summary":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:12:51.000Z","tags":["kev","public-exploit","T1078","T1133","T1588","T1059.004","T1021.004"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.39514,"percentile":0.98611},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"ASUS","product":"RT-AX55 Routers","techniqueIds":["T1078","T1133","T1588","T1059.004","T1021.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}