The vulnerability allows an attacker to embed special characters such as $ or \\ in the command-line username used by the SSH daemon. Injection into the username field can cause the SSH server to execute unintended commands, potentially leading to arbitrary code execution on the host with the privileges of the SSH service.

OpenSSH versions prior to 10.6 on OpenBSD systems are affected. All installations using the legacy command-line username parsing may be vulnerable.

The CVSS score of 2.5 indicates low severity, and the EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker sends a crafted username over SSH; the injection occurs during authentication processing. No additional exploitation conditions are specified in the description.