CVE-2019-17584: High severity meinberg global syncbox/ptpv2 firmware vulnerability
The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions up to v5.34o, v5.34s, v5.32 or 5.34g are affected. The private key is also used in an internal interface of another Meinberg Device and can be extracted from a firmware update of this device. An update to fix the vulnerability was published by the vendor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17584?
CVE-2019-17584 is considered a high severity vulnerability due to its potential to allow unauthorized root access.
What devices are affected by CVE-2019-17584?
CVE-2019-17584 affects Meinberg SyncBox/PTP/PTPv2 devices running firmware versions up to 5.34o, 5.34s, 5.34g, and 5.32.
How do I fix CVE-2019-17584?
To fix CVE-2019-17584, update the firmware of the affected Meinberg devices to a version later than 5.34o, 5.34s, 5.34g, or 5.32.
What is the impact of exploiting CVE-2019-17584?
Exploiting CVE-2019-17584 can lead to complete control over the affected device due to root access via default SSH keys.
Are there any mitigations for CVE-2019-17584?
Mitigations for CVE-2019-17584 include changing the default SSH keys and ensuring firmware is updated to the latest version.