| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| 70123992-100000 | VSE1000-F400-B12-A1000 | < 1.15.0.0 |
| 70123992-100001 | VSE2000-F400-B12-A1000 | < 1.15.0.0 |
| 70123992-100002 | VSE3000-F400-B12-A1000 | < 1.15.0.0 |
| 70123993-100000 | VTE7500-F400-B12-A1500 | < 1.15.0.0 |
The affected devices run a SSH server that is affected by the regreSSHion vulnerability despite the fact that no user can actually log in through SSH. Attackers may exploit this vulnerability to gain root access to the device.
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
An unauthenticated remote attacker can
Remediation
Update to the Firmware version 1.15.0.0.
A firmware update will be made available shortly on the corresponding product page on the Pepper+Fuchs Homepage.
CERT@VDE coordinated with PEPPERL+FUCHS