CVE-2026-14837

highEPSS 0.001 · 1 %ileDEEU
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.11% (1st) EPSS
CVSS 7.8 · high
Is it mine?
12 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · lenze_psirt

EPSS · scored 2026-10-17

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedlenze_psirt

    To resolve this security vulnerability, we recommend installing a firmware update. | Product | Firmware | Fixed Version | | --------------- | -------- | ------------- | | Controller c430 | c4xx | 1.15.2 | | c520 | c5xx | 1.15.2 | | c550 | c5xx | 1.15.2 | | i950 GenA | i950 | 1.15.0 | | i950 GenB | i950 | 2.0.3 |

  • Mitigationlenze_psirt

    Check to see if there is an activation file on the SD Card, and delete it. In addition, it is recommended that you protect each access path with appropriate measures, such as physically securing access to the SD Card, authorizing file transfers via PLC Designer (if supported by the respective product), authorizing file transfers via OPC UA (if supported by the respective product), and customizing the key for SFTP access.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 1.8 · impact 5.9
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Lenze PSIRT DE
v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · info@cert.vde.com
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347US
05

affected products (12)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2026-077Lenze: Incorrect signature validation in the enable SSH routine2026-07-27csaf · lenze_psirtDE

    The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdlenze_psirtNVDCVE.orgMITRE
published 2026-07-27modified 2026-07-30
09

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan