CVE-2023-48795

Vulnerability updated 5 months ago (2024-05-04T17:31:03.380Z)
Download STIX
Preview STIX
CVE-2023-48795 is a significant vulnerability discovered in the Siemens RUGGEDCOM APE1808, specifically in all versions with Palo Alto Networks Virtual NGFW configured to support the CHACHA20-POLY1305 algorithm or any Encrypt-then-MAC algorithms. This flaw, found within the SSH cryptographic network protocol, could potentially allow an attacker to downgrade the connection's security by truncating the extension negotiation message. The vulnerability was identified by academics from Ruhr-Universität Bochum and has been proven exploitable in Terrapin attacks. At the time of discovery, there was no immediate fix available for this vulnerability. This posed a considerable risk for users of the affected software, as it left them susceptible to potential security breaches. The vulnerability, which lies within the design and implementation of the software, has the potential to undermine the security integrity of the systems running the affected versions of the Siemens RUGGEDCOM APE1808. However, a temporary workaround has been proposed to mitigate the risk associated with CVE-2023-48795. Users can resolve this issue by adjusting the configuration of their in-use SSH profile to include at least one cipher and one MAC algorithm. This action effectively removes support for the vulnerable CHACHA20-POLY1305 and all Encrypt-then-MAC algorithms (those with -etm in the name) in the PAN-OS software. While this solution does not completely eliminate the vulnerability, it significantly reduces the risk until a permanent fix is made available.
Description last updated: 2024-04-12T14:17:17.144Z
What's your take? (Question 1 of 2)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Terrapin is a possible alias for CVE-2023-48795. Terrapin is a significant vulnerability discovered in the design and implementation of the Secure Shell (SSH) protocol. This flaw, dubbed as the "Terrapin attack," allows attackers to downgrade the security level of the SSH protocol, which is widely used for secure data communication and remote serv
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
SSH
Vulnerability
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the CVE-2023-48795 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
9 months ago
CERT-EU
9 months ago
CISA
6 months ago
DARKReading
6 months ago
SANS ISC
7 months ago
CERT-EU
7 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
Securityaffairs
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
10 months ago
CERT-EU
10 months ago
CERT-EU
10 months ago