What it is about

OpenSSH ist eine Open Source Implementierung des Secure Shell Protokolls. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• kryptografische Sicherheitsvorkehrungen zu umgehen
• einen Denial of Service Zustand herbeizuführen

Am I affected?

Affected according to the BSI:

• IBM VIOS 3.1
• IBM AIX 7.3
• IBM VIOS 4.1
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• IBM AIX 7.2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• F5 BIG-IP

and 44 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Open Source OpenSSH 9.9p2
• Securepoint UTM 14.0.2
• Dell integrated Dell Remote Access Controller 7.00.00.181
• Dell integrated Dell Remote Access Controller 7.20.30.50
• Fortinet FortiAnalyzer 7.6.3
• Fortinet FortiAnalyzer 7.4.7
• Fortinet FortiAnalyzer 7.2.11
• Fortinet FortiManager 7.6.3
• Fortinet FortiManager 7.4.7
• Fortinet FortiManager 7.2.11
• QNAP NAS QTS 5.2.4.3079 build 20250321
• QNAP NAS QuTS hero h5.2.4.3079 build 20250321

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.