| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| Telepresence Box | < 7.0.0 | |
| Telepresence Box 7.0.0<10.0.0 configuration | older than 08.08.2025 |
The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
In high-traffic sessions, an attacker with access to the network stream may be able to sniff and decrypt the data exchanged during a remote support session. High-traffic sessions typically only contain VNC data, as the machine's screen content is transmitted. A potential attack may also allow the decryption of large software update sessions, which contain software update packages sent from the TRUMPF infrastructure to the machine. However, all vulnerable devices have been excluded from the software update until a secure state is reinstated.
Remediation
Since August 8th, 2025, an automated configuration update is available for TRUMPF machines with a Telepresence Box 7.0.0 and newer. It will automatically be applied when activating a remote session from the machine. A TRUMPF technician doesn't need to join the session. Please refer to your operator's manual on how to activate a remote session on your TRUMPF machine.
The update takes up to 5 minutes. After a successful update, the remote session will automatically be closed. If the session is not automatically closed, then the update has already been applied or is not needed at the machine.
Machines using a Telepresence Box 6.x and older can't use secure encryption. All customers still connecting to TRUMPF with such a device will be identified by TRUMPF and contacted with further information. It is possible to order a new Telepresence Box via your sales representative. In such a case, please contact the TRUMPF Service for installation.
Please note that from July 1st, 2026, onward machines with a Telepresence Box 6.x and older will not be able to connect to the TRUMPF infrastructure any longer.
CERT@VDE coordinated with Trumpf