CVE-2024-6387_Check reads SSH banners to find unpatched OpenSSH

A banner string and a list of known good versions

CVE-2024-6387_Check is a single Python file, and the whole repository is that file plus a README and a licence. The approach is straightforward: an OpenSSH server announces its version in the banner it sends before authentication, so a scanner that connects, reads the banner and compares the version string against a list of patched builds can tell you which hosts are running vulnerable software.

The vulnerability it targets is CVE-2024-6387, known as regreSSHion, and the README calls it a recently discovered issue. The tool is described as lightweight and efficient, built for rapid scanning of multiple IP addresses, domain names and CIDR network ranges.

What the banner approach buys you is speed. No credential is needed, no payload is sent, and a host that does not run SSH at all is identified as a closed port rather than a mystery. The trade is precision. The banner is a string the server chooses to send, so a host that has been configured to hide its version, or that runs a different SSH implementation entirely, is reported as unknown rather than as safe. The README's own output categories admit this, with a separate bucket for servers running an unknown version of SSH.

The detection is version-based rather than behaviour-based. The tool recognises certain patched versions of OpenSSH and excludes them from the vulnerability report, which is why the README mentions that patched versions were added for FreeBSD 13.3, 14.x and 15 in a later release.

The whole command line on one line

The usage syntax is a single invocation of the script with a target list and a set of optional flags:

python CVE-2024-6387_Check.py <targets> [--ports PORTS] [--timeout TIMEOUT] [--list FILE] [--grace-time-check [SECONDS]] [--dns-resolve] [--use-help-request]

The targets argument accepts IP addresses, domain names, file paths containing IP addresses, or CIDR network ranges. The flags each do one thing.

`--timeout TIMEOUT` sets the connection timeout in seconds and defaults to 1 second. `--list FILE` points at a file of IP addresses to check, which is how you scan a large known set rather than typing addresses. `--ports PORTS` takes a comma-separated list of port numbers and defaults to 22. `--dns-resolve` resolves and displays hostnames for IP addresses, which the README says helps identify scanned hosts more clearly.

Two flags are more than cosmetic. `--grace-time-check` takes an optional number of seconds and turns on the LoginGraceTime detection described below, defaulting to 120 seconds. `--use-help-request` sends a HELP request when the initial banner retrieval fails, which the README says helps with SSH configurations that do not return a banner immediately and improves the number of mitigation detections found.

The flag list is short because the tool does one thing. There is no configuration file, no output format option, no exclusion list, and no way to import a target list in a format other than plain text. For a script whose entire content is one file, that is a reasonable amount of surface, and it is also the limit of what you can expect to configure.

Running it against a host, a list, or a CIDR range

The README's examples cover the cases you will actually hit. A single address:

python CVE-2024-6387_Check.py 192.168.1.1

A file of addresses, using the short form of the list flag:

python CVE-2024-6387_Check.py -l ip_list.txt

Several targets mixed, addresses and hostnames together:

python CVE-2024-6387_Check.py 192.168.1.1 example.com 192.168.1.2

A whole subnet, which is where the scanning load starts to matter:

python CVE-2024-6387_Check.py 192.168.1.0/24

Non-standard SSH ports, which matters because SSH is frequently moved:

python CVE-2024-6387_Check.py 192.168.1.1 example.com --ports 22,2222

The last two are the ones to think about before running. A CIDR range means every address in the range gets a connection attempt, and the concurrency is handled with threading, so a large range produces a burst of connections. If you point it at a range that is not yours, or that your monitoring has an alert on, that burst is exactly what a scanner looks like. The tool has no rate limit, no delay between connections, and no way to exclude hosts other than by writing a smaller list.

For IPv6, the README states the tool fully supports IPv6 addresses, and that you can scan both IPv4 and IPv6 addresses directly or through hostname resolution.

Grace time detection: holding a connection open to guess at a setting

The most interesting feature is also the one to think hardest about, because it infers a server configuration from timing rather than reading it.

The idea is this. The regreSSHion issue relates to a race condition in the OpenSSH server's signal handling, and the commonly cited mitigation is setting `LoginGraceTime` to 0, which removes the window during which the unauthenticated pre-authentication code runs. The tool checks whether that mitigation is in place by retrieving the SSH banner and then waiting to see whether the connection stays open. If the server keeps the connection open past the grace period, the README's interpretation is that `LoginGraceTime` might be set to 0 as a mitigation measure. A server that closes the connection at the grace period is the one that is not mitigated.

To turn it on:

python CVE-2024-6387_Check.py 192.168.1.1 --grace-time-check

And with an explicit wait time:

python CVE-2024-6387_Check.py 192.168.1.1 --grace-time-check 150

The default is 120 seconds, which means every target is held for two minutes by default. Across a large list with threading, that is a lot of long-lived half-open connections.

The inference is also indirect. A connection that stays open could mean `LoginGraceTime` is 0, and it could also mean a firewall in the path is holding the socket, that the server is simply slow to reap the process, or that another product is terminating the connection later. The README presents the result as an indication, and the sample output phrases it as remediation not done, but it is a timing heuristic, not a configuration read. A host that stays open for the wrong reason will be reported as mitigated and dropped from your list of things to fix, which is the dangerous direction for that error to go.

What the output actually says, and what it leaves out

The tool summarises the run into categories: servers running a vulnerable version of OpenSSH, servers running a non-vulnerable version, servers running an unknown version of SSH, a count of servers with the port closed, and the total number of targets scanned. The README's sample output shows each entry with the host and the banner string it saw, for example a host reporting `SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2` flagged as likely vulnerable, and one reporting `SSH-2.0-ROSSSH` listed under unknown SSH version.

Two things stand out. First, the version string includes the distribution package suffix, so the tool is reading the vendor's build identifier, not just the upstream OpenSSH version. That is why a per-distribution patched list matters, and why the changelog records additions for specific FreeBSD releases.

Second, the tool reports a server as not vulnerable when it recognises a patched version. It does not verify the running binary, and it cannot tell you whether a patched package is actually deployed rather than merely installed. The category name, servers not vulnerable, is a statement about the advertised version string.

The closed-port count is the least interesting number but the most useful operationally, because it tells you how much of your range is not running SSH at all and can be struck from the list. The README's own sample reports 254 servers with port 22 closed out of 257 targets scanned, which is what a range scan of mixed infrastructure tends to look like.

One file, no dependencies declared, and a 2024 changelog

The repository contains `CVE-2024-6387_Check.py`, the README, a licence and a gitattributes file. There is no requirements file, no pyproject.toml, no test suite and no CI configuration in the top-level entries.

The absence of a dependency manifest is worth understanding rather than ignoring. The tool is a standard-library script as far as the repository records show, and if you run it with a recent Python 3 you can see that for yourself. But nothing in the repository states a minimum Python version, and the topics list python3 without a floor. If the script does import a third-party package, the repository does not say which or how to install it, and you would find out at the point of an ImportError.

The changelog is the other thing to read carefully. It ends in July 2024: version 0.8 on 08 July 2024 added patched versions for FreeBSD 13.3, 14.x and 15 and hostname resolution via `-d` or `--dns-resolve`, and fixed LoginGraceTime detection. Version 0.7 on 06 July 2024 added the `--use-help-request` option and allowed multiple ports to be scanned, in the pull request numbered 30. Version 0.6 on 05 July 2024 introduced LoginGraceTime detection and fixed an issue where hosts with only an IPv6 address could not be tested by hostname.

The repository is not archived, but the last push was on 2026-05-29, and there are no GitHub releases. The project is licensed GPL-3.0, which for a script you run against your own infrastructure is not a practical constraint, though the licence terms are worth reading if you intend to modify and redistribute it. The absence of releases and of a version tag in the repository means there is no upgrade channel to track, so the changelog in the README is the only version history you have.

Editorial conclusion

Adopt CVE-2024-6387_Check if you need a fast, unauthenticated first pass over a known set of hosts to see which OpenSSH servers still advertise a vulnerable build, since it needs no credentials and reads only banners. Do not adopt it as a substitute for patching, as a compliance record, or as a scanner for the public internet, and note that its banner approach cannot see a host that suppresses its version string. Before trusting its output, confirm the patched-version list covers your own distribution's builds, and decide deliberately whether to enable `--grace-time-check`, since that option holds connections open for two minutes by default and will look like a connection attempt to a monitored host.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. xaitax/CVE-2024-6387_Check on GitHub