CVE-2024-0725: ProSSHD 1.2 DOS Vulnerability on Windows

CVE-2024-0725 Overview

CVE-2024-0725 is a denial of service vulnerability in ProSSHD 1.2 running on Microsoft Windows. The flaw resides in unspecified code within the SSH server and is classified under [CWE-404] (Improper Resource Shutdown or Release). Remote attackers can trigger the condition over the network without authentication or user interaction, causing the service to become unavailable. The vulnerability was assigned VulDB identifier 251548, and a public exploit has been disclosed through Packet Storm. The affected build is ProSSHD 1.2_20090726, an unmaintained SSH daemon for Windows platforms.

Critical Impact
Unauthenticated remote attackers can disrupt SSH availability on hosts running ProSSHD 1.2, breaking remote administration and automated file transfer workflows.

Affected Products

ProSSHD 1.2 (build 1.2_20090726)
Microsoft Windows (host operating system)
Any service or workflow relying on the affected SSH daemon for remote access

Discovery Timeline

2024-01-19 - CVE-2024-0725 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0725

Vulnerability Analysis

The vulnerability affects how ProSSHD 1.2 manages resources during SSH session handling on Windows. A specially crafted network input causes the daemon to enter a state where it cannot continue processing requests, resulting in denial of service. The flaw maps to [CWE-404], which covers improper shutdown or release of allocated resources such as sockets, handles, or memory buffers. The EPSS score of 2.033% places this issue in the 84th percentile of vulnerabilities by exploitation likelihood, reflecting the public availability of an Exploit Database entry. The impact is limited to availability — confidentiality and integrity of data are not directly affected by this issue.

Root Cause

The root cause is improper resource management within the SSH service. When ProSSHD processes certain protocol interactions, it fails to correctly release or reset internal resources, leaving the daemon in an unrecoverable state. ProSSHD 1.2 has not received maintenance updates, so the underlying defect remains in shipped binaries.

Attack Vector

An attacker reaches the vulnerable code path by connecting to the ProSSHD listener on its configured TCP port, typically 22. The attack requires no credentials, no privileges, and no user interaction. A single remote session crafted to trigger the resource handling fault is sufficient to halt the service. Detailed reproduction steps are documented in the Packet Storm DoS Exploit advisory and the VulDB Report #251548.

No verified code example is published with this CVE. Defenders should consult the referenced advisory for protocol-level reproduction details rather than rely on synthesized exploit code.

Detection Methods for CVE-2024-0725

Indicators of Compromise

Unexpected termination or crash of the prosshd.exe process on Windows hosts
SSH listener on TCP/22 becoming unresponsive shortly after inbound connections from unknown sources
Windows Event Log entries showing application faults associated with the ProSSHD service
Repeated short-lived TCP connections to the ProSSHD port from a single external address preceding service failure

Detection Strategies

Monitor process lifecycle events for prosshd.exe and alert on unplanned exits or restarts
Correlate SSH connection attempts with subsequent loss of listener availability on TCP/22
Track inbound connection volume against the ProSSHD port and flag anomalous spikes from non-administrative sources
Compare installed ProSSHD versions against 1.2_20090726 during asset inventory scans

Monitoring Recommendations

Enable service availability checks against the SSH listener and alert on consecutive failed probes
Forward Windows Application and System logs to a central log platform for crash analysis
Capture NetFlow or packet metadata for the ProSSHD port to support post-incident investigation
Review perimeter firewall logs for unauthorized external sources reaching internal SSH services

How to Mitigate CVE-2024-0725

Immediate Actions Required

Restrict network access to the ProSSHD listener using host and perimeter firewalls, allowing only known administrative source addresses
Inventory all Windows hosts running ProSSHD 1.2_20090726 and prioritize them for migration
Migrate to a maintained SSH server for Windows, such as OpenSSH for Windows, where security updates are actively published
Disable the ProSSHD service on systems where remote SSH access is not required

Patch Information

No vendor patch has been published in the references associated with CVE-2024-0725. ProSSHD 1.2 build 1.2_20090726 is the affected release, and no fixed version is identified in NVD or in the VulDB #251548 entry. Organizations should plan replacement of the software rather than wait for a fix.

Workarounds

Place the ProSSHD service behind a VPN or bastion host so it is not directly reachable from untrusted networks
Apply rate limiting and connection throttling at the network layer to reduce the probability of a successful denial of service
Configure automatic service recovery in Windows Service Control Manager to restart prosshd.exe after a crash
Replace ProSSHD with a supported SSH implementation as the long-term remediation

bash

# Example: restrict inbound SSH to ProSSHD using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Restrict ProSSHD Inbound" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 22 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block ProSSHD Other Sources" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 22 `
  -Action Block

# Configure automatic restart on service failure
sc.exe failure "ProSSHD" reset= 86400 actions= restart/5000/restart/5000/restart/5000