CVE-2016-10009

highPriorität · beachten · 52EPSS 0.374 · 99. PerzentilExploit · funktionalCHDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · funktional
Likely / severe?
37.4% (99th) EPSS
CVSS 7.5 · high
Is it mine?
149 products
Prüfe deine Angriffsfläche
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · abb_psirt

EPSS · bewertet 2026-10-22

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenopenssh-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-askpass-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-cavs-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-clients-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-debuginfo-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-keycat-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-ldap-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenopenssh-server-sysvinit-0:7.4p1-11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • Behobenpam_ssh_agent_auth-0:0.10.3-1.11.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2017:2029
  • BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • MitigationARM600abb_psirt

    Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended. 1. Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet. 2. Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client). 4. Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic. 6. If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ). 7. Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system. 8. Use administrator (i.e., root user) privileges only when required by the task. 9. Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring. 10. Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following: a. Check that the entire system has backups available from all applicable parts. b. Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms. c. Ensure the security of the configuration PCs that may have local copies of device configurations. d. Validate the backups to make sure that they’re working. 11. Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual. 12. Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system 13. Consider hardening the system according to the following: a. Remove any unnecessary communication links in the system. b. If possible, close unused physical ports. c. Open only the necessary TCP/UDP ports in the configuration. d. Remove all unnecessary user accounts. e. Restrict traffic by firewall. f. Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible). g. Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported. h. Remove or deactivate all unused processes, communication ports and services, where possible. i. Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

  • MitigationSWabb_psirt

    Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended. 1. Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet. 2. Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client). 4. Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic. 6. If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ). 7. Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system. 8. Use administrator (i.e., root user) privileges only when required by the task. 9. Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring. 10. Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following: a. Check that the entire system has backups available from all applicable parts. b. Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms. c. Ensure the security of the configuration PCs that may have local copies of device configurations. d. Validate the backups to make sure that they’re working. 11. Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual. 12. Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system 13. Consider hardening the system according to the following: a. Remove any unnecessary communication links in the system. b. If possible, close unused physical ports. c. Open only the necessary TCP/UDP ports in the configuration. d. Remove all unnecessary user accounts. e. Restrict traffic by firewall. f. Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible). g. Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported. h. Remove or deactivate all unused processes, communication ports and services, where possible. i. Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

  • MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot

    Deactivate the webserver if not required, and if deactivation is supported by the product

  • MitigationARM600cisa_csaf_ot

    Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended. 1. Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet. 2. Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client). 4. Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic. 6. If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ). 7. Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system. 8. Use administrator (i.e., root user) privileges only when required by the task. 9. Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring. 10. Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following: a. Check that the entire system has backups available from all applicable parts. b. Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms. c. Ensure the security of the configuration PCs that may have local copies of device configurations. d. Validate the backups to make sure that they’re working. 11. Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual. 12. Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system 13. Consider hardening the system according to the following: a. Remove any unnecessary communication links in the system. b. If possible, close unused physical ports. c. Open only the necessary TCP/UDP ports in the configuration. d. Remove all unnecessary user accounts. e. Restrict traffic by firewall. f. Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible). g. Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported. h. Remove or deactivate all unused processes, communication ports and services, where possible. i. Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

  • MitigationSWcisa_csaf_ot

    Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended. 1. Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet. 2. Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client). 4. Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic. 6. If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ). 7. Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system. 8. Use administrator (i.e., root user) privileges only when required by the task. 9. Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring. 10. Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following: a. Check that the entire system has backups available from all applicable parts. b. Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms. c. Ensure the security of the configuration PCs that may have local copies of device configurations. d. Validate the backups to make sure that they’re working. 11. Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual. 12. Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system 13. Consider hardening the system according to the following: a. Remove any unnecessary communication links in the system. b. If possible, close unused physical ports. c. Open only the necessary TCP/UDP ports in the configuration. d. Remove all unnecessary user accounts. e. Restrict traffic by firewall. f. Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible). g. Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported. h. Remove or deactivate all unused processes, communication ports and services, where possible. i. Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4
v3.07.3highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.4
v2.04.6mediumAV:N/AC:H/Au:S/C:P/I:P/A:Psecondary · Red Hat Product Security US
v3.06.6mediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US
v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU
v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.4
v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Hsecondary · CVSS-BT (t0sche)
v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:Csecondary · ABB PSIRT
v3.17.3highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:Csecondary · CISA US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-426USprimärCWE-426USCWE-426USCWE-426USCWE-426US
05

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

06

betroffene Produkte (149)

Betroffene Produkte und Versionsbereiche.

20 von 149 angezeigt
07

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

  • 2NGA002579ABB Arctic communication solution ARM600 Vulnerabilities2025-04-07csaf · abb_psirtCH

    ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code. As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities. As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

  • RHSA-2017:2029Red Hat Security Advisory: openssh security, bug fix, and enhancement update2017-08-01csaf · redhat_csafUS

    An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • SSA-412672SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.72022-12-13csaf · siemens_psirtDE

    SCALANCE X-200RNA switch devices before V3.2.7 contain multiple OpenSSL and OpenSSH vulnerabilities. The most severe of these vulnerabilities could allow a denial of service condition or could lead to execution of arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • WID-SEC-W-2023-1996OpenSSH: Mehrere SchwachstellenDeutsch2016-12-19csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, seine Privilegien zu erweitern oder einen Denial of Service Angriff durchzuführen.

  • ICSA-22-349-21Siemens SCALANCE X-200RNA Switch Devices2022-12-13icsa · cisa_csaf_otUS

    SCALANCE X-200RNA switch devices before V3.2.7 contain multiple OpenSSL and OpenSSH vulnerabilities. The most severe of these vulnerabilities could allow a denial of service condition or could lead to execution of arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-25-105-08ABB M2M Gateway2025-04-07icsa · cisa_csaf_otUS

    ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code. As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities. As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

08

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

09

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduabb_psirtcert_bundredhat_csafsiemens_psirtcisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2017-01-05geändert 2026-06-17
11

Referenzen (73)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan