Summary
Several vulnerabilities in the Endress+Hauser SSG-E210GC product were discoverd. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected.
Details
Impact
If exploited, these vulnerabilities could potentially allow a remote, unauthenticated attacker to compromise the availability, integrity, and confidentiality of the SSG-E210GC. SICK therefore recommends ensuring that the product operates within a secure environment. Currently, SICK is not aware of any exploits targeting these vulnerabilities.
Mitigation
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Remediation
Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.
Vulnerabilities 23
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
Critical 9.8
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
High 7.4
A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is …
-
High 7.0
OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) be…
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
Medium 6.5
An option refcount overflow exists in dhcpd
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decreme…
-
Medium 6.5
DHCP memory leak
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.
-
Medium 5.9
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorith…
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Low 3.7
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but…
-
Unscored —
OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence…
-
Unscored —
Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red H…
-
Unscored —
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the abil…
-
Unscored —
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, wh…
-
Unscored —
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from …
-
Unscored —
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstr…
-
Unscored —
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protoco…
-
Unscored —CVE-2021-41617 Public exploit
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalati…
-
Unscored —CVE-2021-41874 Rejected
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showe…
-
Unscored —
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
-
Unscored —
In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance i…
Revision history
-
#1.0.0
Initial version
References
-
Endress+Hauser
https://www.endress.com
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1