Summary
The affected devices run a SSH server that is affected by the regreSSHion vulnerability despite the fact that no user can actually log in through SSH. Attackers may exploit this vulnerability to gain root access to the device.
Details
Impact
An unauthenticated remote attacker can
• read files from the device
• modify or delete data on the device
• can interrupt the device functionality
Remediation
Update to the Firmware version 1.15.0.0.
A firmware update will be made available shortly on the corresponding product page on the Pepper+Fuchs Homepage.
Vulnerabilities 1
-
High 8.1
Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…
Revision history
-
#3
Fix: version space, added distribution
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
Pepperl+Fuchs PSIRT
https://pepperl-fuchs.com/cybersecurity
-
CERT@VDE Security Advisories for Pepperl+Fuchs SE
https://certvde.com/en/advisories/vendor/Pepperl+Fuchs
-
VDE-2024-063: PEPPERL+FUCHS: Multiple products are affected by regreSSHion - HTML
https://certvde.com/en/advisories/VDE-2024-063