{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"organization":"Qualys Threat Research Unit (TRU)","summary":"reporting"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.","title":"Summary"},{"category":"description","text":"The vulnerability can lead to unauthenticated remote code execution.","title":"Impact"},{"category":"description","text":"Disable SSH Access via CLI Command or Config Import locally or for a centrally managed device by changing the configuration in SMART EMSRefer to eG OS manual chapter 4.26 for further information","title":"Mitigation"},{"category":"description","text":"Update egOS on affected products to version v1.5.4","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"psirt@welotec.com","name":"Welotec GmbH","namespace":"https://welotec.com"},"references":[{"category":"self","summary":"VDE-2024-043: Welotec: Multiple products are vulnerable to regreSSHion - HTML","url":"https://certvde.com/en/advisories/VDE-2024-043/"},{"category":"self","summary":"VDE-2024-043: Welotec: Multiple products are vulnerable to regreSSHion - CSAF","url":"https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-043.json"},{"category":"external","summary":"Vendor PSIRT","url":"https://welotec.com"},{"category":"external","summary":"CERT@VDE Security Advisories for Welotec GmbH","url":"https://certvde.com/en/advisories/vendor/welotec/"}],"title":"Welotec: Multiple products are vulnerable to regreSSHion","tracking":{"aliases":["VDE-2024-043"],"current_release_date":"2024-08-22T06:00:00.000Z","generator":{"date":"2025-04-14T08:39:21.553Z","engine":{"name":"Secvisogram","version":"2.5.23"}},"id":"VDE-2024-043","initial_release_date":"2024-08-22T06:00:00.000Z","revision_history":[{"date":"2024-08-22T06:00:00.000Z","number":"1","summary":"Initial revision."}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"EG500Mk2-A11001-000101","product":{"name":"EG500Mk2-A11001-000101","product_id":"CSAFPID-11001","product_identification_helper":{"model_numbers":["WEG500100170"]}}},{"category":"product_name","name":"EG500Mk2-A11001-000201","product":{"name":"EG500Mk2-A11001-000201","product_id":"CSAFPID-11002","product_identification_helper":{"model_numbers":["WEG500100290"]}}},{"category":"product_name","name":"EG500Mk2-A11101-000101","product":{"name":"EG500Mk2-A11101-000101","product_id":"CSAFPID-11003","product_identification_helper":{"model_numbers":["WEG500100160"]}}},{"category":"product_name","name":"EG500Mk2-A12011-000101","product":{"name":"EG500Mk2-A12011-000101","product_id":"CSAFPID-11004","product_identification_helper":{"model_numbers":["WEG500100280"]}}},{"category":"product_name","name":"EG500Mk2-B11001-000101","product":{"name":"EG500Mk2-B11001-000101","product_id":"CSAFPID-11005","product_identification_helper":{"model_numbers":["WEG500100190"]}}},{"category":"product_name","name":"EG500Mk2-B11101-000101","product":{"name":"EG500Mk2-B11101-000101","product_id":"CSAFPID-11006","product_identification_helper":{"model_numbers":["WEG500100180"]}}},{"category":"product_name","name":"EG500Mk2-C11001-000101","product":{"name":"EG500Mk2-C11001-000101","product_id":"CSAFPID-11007","product_identification_helper":{"model_numbers":["WEG500100270"]}}},{"category":"product_name","name":"EG500Mk2-C11101-000101","product":{"name":"EG500Mk2-C11101-000101","product_id":"CSAFPID-11008","product_identification_helper":{"model_numbers":["WEG500100260"]}}},{"category":"product_name","name":"EG503L","product":{"name":"EG503L","product_id":"CSAFPID-11009","product_identification_helper":{"model_numbers":["WEG500100020"]}}},{"category":"product_name","name":"EG503L_4GB","product":{"name":"EG503L_4GB","product_id":"CSAFPID-11010","product_identification_helper":{"model_numbers":["WEG500100040"]}}},{"category":"product_name","name":"EG503L-G","product":{"name":"EG503L-G","product_id":"CSAFPID-11011","product_identification_helper":{"model_numbers":["WEG500100130"]}}},{"category":"product_name","name":"EG503W","product":{"name":"EG503W","product_id":"CSAFPID-11012","product_identification_helper":{"model_numbers":["WEG500100010"]}}},{"category":"product_name","name":"EG503W_4GB","product":{"name":"EG503W_4GB","product_id":"CSAFPID-11013","product_identification_helper":{"model_numbers":["WEG500100030"]}}},{"category":"product_name","name":"EG602L","product":{"name":"EG602L","product_id":"CSAFPID-11014","product_identification_helper":{"model_numbers":["WEG600100020"]}}},{"category":"product_name","name":"EG602W","product":{"name":"EG602W","product_id":"CSAFPID-11015","product_identification_helper":{"model_numbers":["WEG600100010"]}}},{"category":"product_name","name":"EG603L Mk2","product":{"name":"EG603L Mk2","product_id":"CSAFPID-11016","product_identification_helper":{"model_numbers":["WEG600100050"]}}},{"category":"product_name","name":"EG603W Mk2","product":{"name":"EG603W Mk2","product_id":"CSAFPID-11017","product_identification_helper":{"model_numbers":["WEG600100040"]}}},{"category":"product_name","name":"EG802W","product":{"name":"EG802W","product_id":"CSAFPID-11018","product_identification_helper":{"model_numbers":["WEG800100010"]}}},{"category":"product_name","name":"EG802W_i7_512GB_DinRail","product":{"name":"EG802W_i7_512GB_DinRail","product_id":"CSAFPID-11019","product_identification_helper":{"model_numbers":["WEG800100040"]}}},{"category":"product_name","name":"EG802W_i7_512GB_w/o DinRail","product":{"name":"EG802W_i7_512GB_w/o DinRail","product_id":"CSAFPID-11020","product_identification_helper":{"model_numbers":["WEG800100050"]}}},{"category":"product_name","name":"EG804W","product":{"name":"EG804W","product_id":"CSAFPID-11021","product_identification_helper":{"model_numbers":["WEG800100020"]}}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"<=v1.5.3","product":{"name":"Firmware <=v1.5.3","product_id":"CSAFPID-21001"}},{"category":"product_version","name":"v1.5.4","product":{"name":"Firmware v1.5.4","product_id":"CSAFPID-22001"}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"Welotec"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015","CSAFPID-31016","CSAFPID-31017","CSAFPID-31018","CSAFPID-31019","CSAFPID-31020","CSAFPID-31021"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014","CSAFPID-32015","CSAFPID-32016","CSAFPID-32017","CSAFPID-32018","CSAFPID-32019","CSAFPID-32020","CSAFPID-32021"],"summary":"Fixed products."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-A11001-000101","product_id":"CSAFPID-31001"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-A11001-000201","product_id":"CSAFPID-31002"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-A11101-000101","product_id":"CSAFPID-31003"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-A12011-000101","product_id":"CSAFPID-31004"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-B11001-000101","product_id":"CSAFPID-31005"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-B11101-000101","product_id":"CSAFPID-31006"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-C11001-000101","product_id":"CSAFPID-31007"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG500Mk2-C11101-000101","product_id":"CSAFPID-31008"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11008"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG503L","product_id":"CSAFPID-31009"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11009"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG503L_4GB","product_id":"CSAFPID-31010"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11010"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG503L-G","product_id":"CSAFPID-31011"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11011"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG503W","product_id":"CSAFPID-31012"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11012"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG503W_4GB","product_id":"CSAFPID-31013"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11013"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG602L","product_id":"CSAFPID-31014"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11014"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG602W","product_id":"CSAFPID-31015"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11015"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG603L Mk2","product_id":"CSAFPID-31016"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11016"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG603W Mk2","product_id":"CSAFPID-31017"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11017"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG802W","product_id":"CSAFPID-31018"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11018"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG802W_i7_512GB_DinRail","product_id":"CSAFPID-31019"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11019"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG802W_i7_512GB_w/o DinRail","product_id":"CSAFPID-31020"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11020"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.3 installed on EG804W","product_id":"CSAFPID-31021"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11021"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-A11001-000101","product_id":"CSAFPID-32001"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-A11001-000201","product_id":"CSAFPID-32002"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-A11101-000101","product_id":"CSAFPID-32003"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-A12011-000101","product_id":"CSAFPID-32004"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-B11001-000101","product_id":"CSAFPID-32005"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-B11101-000101","product_id":"CSAFPID-32006"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-C11001-000101","product_id":"CSAFPID-32007"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG500Mk2-C11101-000101","product_id":"CSAFPID-32008"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11008"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG503L","product_id":"CSAFPID-32009"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11009"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG503L_4GB","product_id":"CSAFPID-32010"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11010"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG503L-G","product_id":"CSAFPID-32011"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11011"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG503W","product_id":"CSAFPID-32012"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11012"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG503W_4GB","product_id":"CSAFPID-32013"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11013"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG602L","product_id":"CSAFPID-32014"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11014"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG602W","product_id":"CSAFPID-32015"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11015"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG603L Mk2","product_id":"CSAFPID-32016"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11016"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG603W Mk2","product_id":"CSAFPID-32017"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11017"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG802W","product_id":"CSAFPID-32018"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11018"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG802W_i7_512GB_DinRail","product_id":"CSAFPID-32019"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11019"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG802W_i7_512GB_w/o DinRail","product_id":"CSAFPID-32020"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11020"},{"category":"installed_on","full_product_name":{"name":"Firmware v1.5.4 installed on EG804W","product_id":"CSAFPID-32021"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11021"}]},"vulnerabilities":[{"cve":"CVE-2024-6387","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"category":"description","text":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014","CSAFPID-32015","CSAFPID-32016","CSAFPID-32017","CSAFPID-32018","CSAFPID-32019","CSAFPID-32020","CSAFPID-32021"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015","CSAFPID-31016","CSAFPID-31017","CSAFPID-31018","CSAFPID-31019","CSAFPID-31020","CSAFPID-31021"]},"remediations":[{"category":"mitigation","details":"Disable SSH Access via CLI Command or Config Import locally or for a centrally managed device by changing the configuration in SMART EMSRefer to eG OS manual chapter 4.26 for further information","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update egOS on affected products to version v1.5.4","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":8.1,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":8.1,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015","CSAFPID-31016","CSAFPID-31017","CSAFPID-31018","CSAFPID-31019","CSAFPID-31020","CSAFPID-31021"]}],"title":"CVE-2024-6387"}]}