Summary
TruControl laser control software prior to version 1.60.0 uses an OpenSSH server version affected by CVE-2024-6387. The affected OpenSSH Server version could potentially lead to a remote code execution.
Details
Impact
To be able to exploit this vulnerability the attacker first needs to gain any kind of network access to the system.
The remote code execution vulnerability enables the attacker a potential access into the laser control system which could lead to following possible impacts/damages to the system:
* Data loss in the laser control
* Standstill of production
Damage by change of the laser control
Safety is not affected since it is controlled by an independent electromechanical safety mechanism.
Remediation
Update to the newest release 4.04.0 of the TruControl software version
Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the newest major release 4.04.0 of the TruControl software version
Vulnerabilities 1
-
High 8.1
Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…
Revision history
-
#4
Fixed CSAF self-reference URL
-
#3
removed issuing authority as it is the same as the publisher
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
TRUMPF Laser SE - PSIRT
https://www.trumpf.com/en_US/meta/security-with-trumpf/security-advisories/
-
CERT@VDE Security Advisories for TRUMPF Laser
https://certvde.com/en/advisories/vendor/trumpf-laser/
-
VDE-2024-040: Multiple TRUMPF products prone to regreSSHion OpenSSH server vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2024-040/