Back to overview

MB connect line: Multiple products are vulnerable to regreSSHion

VDE-2024-042
Last update
08/17/2023 14:00
Published at
08/17/2023 14:00
Vendor(s)
MB connect line GmbH
External ID
VDE-2024-042
CSAF Document
Download

Summary

Several Red Lion Europe products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

Impact

Possible full system compromise where an attacker can execute arbitrary code with the highest privileges.

Affected Product(s)

Model no. Product name Affected versions
mbCONNECT24 <2.16.1 mbCONNECT24 <2.16.1
mbNET 8.0.0<8.2.0 mbNET 8.0.0<8.2.0
mbNET.rokey 8.0.0<8.2.0 mbNET.rokey 8.0.0<8.2.0
mymbCONNECT24 <2.16.1 mymbCONNECT24 <2.16.1
mbCONNECT24 <2.16.1 mbCONNECT24 <2.16.1
mbNET 8.0.0<8.2.0 mbNET 8.0.0<8.2.0
mbNET.rokey 8.0.0<8.2.0 mbNET.rokey 8.0.0<8.2.0
mymbCONNECT24 <2.16.1 mymbCONNECT24 <2.16.1

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:57
Severity
8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Summary

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References
cve.org | nvd.nist.gov

Mitigation

Prevent all access to the sshd daemon listening on port 22.

Remediation

Update to latest firmware:

2.16.1 for mbCONNECT24/mymbCONNECT24
8.2.0 for mbNET/mbNET.rokey

Revision History

Version Date Summary
1.0.0 08/17/2023 14:00 Initial revision.