CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2024-6387

CVE-2024-6387: regreSSHion - Time is a Flat Circle (of Root Shells)

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 3, 2026·5 min read·211 visits

Executive Summary (TL;DR)

OpenSSH's sshd calls unsafe functions (syslog) inside a signal handler. By winning a precise race condition, an attacker can corrupt the heap and gain unauthenticated root access. It takes about 6-8 hours of continuous attempts to exploit, but the result is a full system compromise.

A signal handler race condition in OpenSSH's server (sshd) allows unauthenticated remote attackers to achieve root code execution on glibc-based Linux systems. This is a regression of CVE-2006-5051, proving that code history repeats itself if you don't write regression tests.

Official Patches

OpenSSHOfficial Release Notes
UbuntuUbuntu Security Advisory

Fix Analysis (1)

Technical Appendix

CVSS Score
8.1/ 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
4.20%
Top 15% most exploited
14,000,000
via Shodan

Affected Systems

OpenSSH servers running on glibc-based Linux systemsVersions 8.5p1 through 9.7p1

Affected Versions Detail

Product
Affected Versions
Fixed Version
OpenSSH
OpenBSD
>= 8.5p1, < 9.8p19.8p1
AttributeDetail
Attack VectorNetwork (Port 22)
ComplexityHigh (Race Condition)
PrivilegesNone (Unauthenticated)
CVSS v3.18.1 (High)
CWECWE-364: Signal Handler Race Condition
Exploit StatusProof of Concept Available

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1068Exploitation for Privilege Escalation
Privilege Escalation
CWE-364
Signal Handler Race Condition

The software executes a signal handler that calls a non-reentrant function, leading to undefined behavior or memory corruption.

Known Exploits & Detection

QualysOriginal technical advisory and PoC strategy
NucleiDetection Template Available

Vulnerability Timeline

Vulnerability Disclosed by Qualys
2024-07-01
OpenSSH 9.8p1 Released
2024-07-01
Added to CISA KEV
2024-07-08

References & Sources

  • [1]Qualys Research Blog
Related Vulnerabilities
CVE-2006-5051

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•13 minutes ago•CVE-2026-54569
9.8

CVE-2026-54569: Remote Code Execution via Missing Authorization and Eval Injection in senaite.core

SENAITE LIMS core framework (senaite.core) versions 2.0.0 through 2.6.0 contain a critical vulnerability chain that permits unauthenticated remote code execution. By combining a Missing Authorization flaw (CWE-862) in multiple JSON API endpoints with an Unsafe Evaluation flaw (CWE-95) during custom field deserialization, an attacker can execute arbitrary Python commands. This execution occurs under the privileges of the hosting Zope process, creating severe risk to laboratory systems, physical instrumentation databases, and host system integrity.

Alon Barad
Alon Barad
0 views•7 min read
•about 1 hour ago•GHSA-7W8C-QGXG-M7JX
8.0

GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates

A Stored Cross-Site Scripting (XSS) vulnerability exists within the legacy presentation templates of the LibreNMS network monitoring system. Due to inadequate context-aware output encoding of operational data ingested via Simple Network Management Protocol (SNMP) polling, Border Gateway Protocol (BGP) notifications, and incoming Syslog messages, an administrative user viewing device dashboards can be targeted with arbitrary JavaScript execution.

Amit Schendel
Amit Schendel
1 views•6 min read
•about 2 hours ago•CVE-2026-54614
4.3

CVE-2026-54614: Unsafe Reflection and Arbitrary Class Instantiation in cakephp/debug_kit MailPreview

CVE-2026-54614 is an unsafe reflection vulnerability in the MailPreview component of cakephp/debug_kit prior to versions 4.10.3 and 5.2.4. Unauthenticated or low-privileged remote attackers can exploit this vulnerability to dynamically resolve and instantiate arbitrary PHP classes within the Composer autoloader environment, leading to constructor and destructor execution.

Alon Barad
Alon Barad
2 views•7 min read
•about 3 hours ago•CVE-2026-54590
5.9

CVE-2026-54590: Path Traversal and Authentication Bypass in AsyncSSH via Username Token Substitution

An incomplete input sanitization fix in AsyncSSH version 2.23.0 allows unauthenticated remote attackers to bypass directory restriction controls and perform path-traversal attacks. When the system is configured to perform username token substitution inside its AuthorizedKeysFile directive, attackers can manipulate downstream path resolution mechanisms via tilde expansion and environment variable references. This flaw permits authentication bypasses by forcing the server to read public keys from unauthorized file locations outside the restricted environment.

Amit Schendel
Amit Schendel
3 views•6 min read
•about 4 hours ago•CVE-2026-54591
8.1

CVE-2026-54591: Arbitrary File Overwrite via Path Traversal in AsyncSSH SCP Implementation

CVE-2026-54591 is a high-severity path traversal vulnerability in AsyncSSH's SCP implementation prior to version 2.23.1. When an AsyncSSH-based SCP client connects to a malicious or compromised SSH server and performs a file transfer, the server can send crafted filenames containing relative path sequences. Because the client failed to validate these filenames before resolving the final storage path, a malicious server could write or overwrite arbitrary files on the client machine within the security context of the executing application. This vulnerability is mapped to GitHub Security Advisory GHSA-2wxc-x7rj-hg8f.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 7 hours ago•CVE-2026-55419
5.3

CVE-2026-55419: Unrestricted File Upload in Pollen Robotics Reachy Mini SDK

An unrestricted file upload vulnerability exists in the Pollen Robotics Reachy Mini robot daemon prior to version 1.8.2. Unauthenticated remote attackers can upload arbitrary files to the temporary sounds directory over the network, leading to disk pollution and staging for potential secondary local exploits.

Alon Barad
Alon Barad
6 views•5 min read