{"document":{"acknowledgments":[{"organization":"CERTVDE","summary":"coordination","urls":["https://certvde.com"]}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named \"regreSSHion\".","title":"Summary"},{"category":"description","text":"Possible full system compromise where an attacker can execute arbitrary code with the highest privileges.","title":"Impact"},{"category":"description","text":"Prevent all access to the sshd daemon listening on port 22.","title":"Mitigation"},{"category":"description","text":"Update to latest firmware: \n\n * 2.16.1 for myREX24 V2/myREX24 V2 virtual \n * 8.2.0 for REX200/REX250","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"psirt@helmholz.de","name":"Helmholz GmbH & Co. KG","namespace":"https://www.helmholz.de"},"references":[{"category":"external","summary":"psirt@helmholz.de","url":"https://www.helmholz.de"},{"category":"external","summary":"CERT@VDE Security Advisories","url":"https://certvde.com/en/advisories/vendor/helmholz/"},{"category":"self","summary":"VDE-2024-044: Helmholz: Multiple products are vulnerable to regreSSHion - HTML","url":"https://certvde.com/en/advisories/VDE-2024-044/"},{"category":"self","summary":"VDE-2024-044: Helmholz: Multiple products are vulnerable to regreSSHion - CSAF","url":"https://helmholz.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-044.json"}],"title":"Helmholz: Multiple products are vulnerable to regreSSHion","tracking":{"aliases":["VDE-2024-044"],"current_release_date":"2025-05-14T12:28:19.000Z","generator":{"date":"2024-09-25T09:30:45.003Z","engine":{"name":"Secvisogram","version":"2.5.12"}},"id":"VDE-2024-044","initial_release_date":"2024-07-31T08:00:00.000Z","revision_history":[{"date":"2024-07-31T08:00:00.000Z","number":"1","summary":"initial revision"},{"date":"2025-05-14T12:28:19.000Z","number":"2","summary":"Fix: version space, added distribution"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"myREX24 V2","product":{"name":"myREX24 V2","product_id":"CSAFPID-11001"}},{"category":"product_name","name":"myREX24 V2 virtual","product":{"name":"myREX24 V2 virtual","product_id":"CSAFPID-11002"}},{"category":"product_name","name":"REX200","product":{"name":"REX200","product_id":"CSAFPID-11003"}},{"category":"product_name","name":"REX250","product":{"name":"REX250","product_id":"CSAFPID-11004"}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"<2.16.1","product":{"name":"Firmware <2.16.1","product_id":"CSAFPID-21001"}},{"category":"product_version","name":"2.16.1","product":{"name":"Firmware 2.16.1","product_id":"CSAFPID-22001"}},{"category":"product_version_range","name":"8.0.0<8.2.0","product":{"name":"Firmware 8.0.0<8.2.0","product_id":"CSAFPID-21003"}},{"category":"product_version","name":"8.2.0","product":{"name":"Firmware 8.2.0","product_id":"CSAFPID-22003"}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"Helmholz GmbH & Co. KG"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"],"summary":"Affected Products"},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004"],"summary":"Fixed Products"}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <2.16.1 installed on myREX24 V2","product_id":"CSAFPID-31001"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.16.1 installed on myREX24 V2","product_id":"CSAFPID-32001"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <2.16.1 installed on myREX24 V2 virtual","product_id":"CSAFPID-31002"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.16.1 installed on myREX24 V2 virtual","product_id":"CSAFPID-32002"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 8.0.0<8.2.0 installed on REX200","product_id":"CSAFPID-31003"},"product_reference":"CSAFPID-21003","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware 8.2.0 installed on REX200","product_id":"CSAFPID-32003"},"product_reference":"CSAFPID-22003","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware 8.0.0<8.2.0 installed on REX250","product_id":"CSAFPID-31004"},"product_reference":"CSAFPID-21003","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware 8.2.0 installed on REX250","product_id":"CSAFPID-32004"},"product_reference":"CSAFPID-22003","relates_to_product_reference":"CSAFPID-11004"}]},"vulnerabilities":[{"cve":"CVE-2024-6387","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"audience":"all","category":"description","text":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"remediations":[{"category":"mitigation","details":"Prevent all access to the sshd daemon listening on port 22.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update to latest firmware: \n\n * 2.16.1 for myREX24 V2/myREX24 V2 virtual \n * 8.2.0 for REX200/REX250","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":8.1,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":8.1,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"CVE-2024-6387"}]}