Severity: Partially affected, action required
A signal handler race condition was found in OpenSSH’s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd’s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This issue is also known as ‘RegreSSHion’ or CVE-2024-6387.
Affected Products
| Product | Severity |
|---|---|
| XC3 (52-7520 & 52-7523) | Affected |
| XS3 (52-7500) | Affected |
| XD3 (52-7550 & 52-7554) | Not affected |
Mitigation
It is advised to disable the ‘DHD Support Access’ checkbox in WebApps > System App > Network Settings > Manage Services, as already recommended by DHD. DHD Support Access is already disabled by default. If it was not enabled manually by intention, no further action is required. DHD highly recommends to keep this service disabled unless explicitly advised by DHD support.
It is important to note that the likelihood of this exploit being successfully executed is very low. The specific circumstances required for this vulnerability to be exploited necessitate network-level access to the device, which should be typically well-protected in secure environments. Only if an attacker has such access and the exact conditions are met this vulnerability could be leveraged. Nonetheless, DHD has chosen to actively inform our users about this potential threat to ensure they are aware and can take appropriate precautions.
One of DHD’s top priorities is the safety and reliability of our products. We will continue to investigate further threats eventually arising from CVE-2024-6387 and inform you on any news.