High VDE-2024-042 1 CVE

MB connect line: Multiple products are vulnerable to regreSSHion

Published Aug 17, 2023 · Updated Aug 17, 2023

Vendor: MB connect line Vendor: Red Lion Europe Product: mbCONNECT24 Product: mbCONNECT24 Product: mbNET Product: mbNET Product: mbNET.rokey Product: mbNET.rokey Product: mymbCONNECT24 Product: mymbCONNECT24

Summary

Several Red Lion Europe products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

Details

Impact
Possible full system compromise where an attacker can execute arbitrary code with the highest privileges.

Mitigation
Prevent all access to the sshd daemon listening on port 22.

Remediation
Update to latest firmware:

2.16.1 for mbCONNECT24/mymbCONNECT24
8.2.0 for mbNET/mbNET.rokey

Vulnerabilities 1

High 8.1

CVE-2024-6387 Public exploit EPSS 100%

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Jul 1, 2024

Revision history

2023-08-17 #1.0.0
Initial revision.

References

CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline/
VDE-2024-042: MB connect line: Multiple products are vulnerable to regreSSHion - HTML
https://certvde.com/en/advisories/VDE-2024-042/