Qualys researchers say an OpenSSH flaw can let attackers remotely compromise servers and allow unauthenticated RCE as root; over 14M servers may be vulnerable
CSOLucian Constantin
Context & Ripple Effects
This disclosure returns OpenSSH to the center of a long-running security burden: earlier patches addressed client private-key leakage caused by malicious servers, while later research found broad weaknesses in cryptographic keys used in SSH connections. The new report shifts the immediate concern to exposed server access and root-level compromise.
It also follows reports of remotely exploitable flaws in other widely deployed administration and infrastructure software, including confirmed exploitation of a ConnectWise remote-access flaw and critical Exim vulnerabilities. That makes remediation speed and asset visibility consequential, not merely a software-update task.
First-order effects
Organizations running affected OpenSSH servers must identify exposed instances and apply the available mitigation or update; successful exploitation could give an unauthenticated attacker root-level execution.
Qualys’ estimate puts infrastructure teams, hosting providers, and operators of internet-facing Linux servers under immediate pressure to verify version and configuration exposure rather than assume SSH access is safe by default.
Second-order effects
Security teams are likely to prioritize external SSH inventories, access logging, and incident review alongside patching, because a root compromise can create follow-on credential and persistence risks.
Vendors and managed-service providers that operate customer servers face higher support demand and tighter change-control decisions, especially where updates may interact with existing SSH compatibility requirements.
Third-order effects
If recurring flaws in foundational remote-access components continue, server operators will have to treat SSH exposure as a continuously managed attack surface, with faster asset discovery and shorter remediation cycles.
The pattern strengthens the case for defense in depth around administrative access: a single widely deployed service vulnerability can turn patch latency and incomplete inventory into systemic operational risk.
The trend: This is another data point in the hardening of ubiquitous remote-administration infrastructure, where the scale of deployment makes vulnerabilities as important as the quality of the patch response.
Your SSH server should always be restricted to only networks you trust to reduce your risks. If not, well once in a while @qualys finds something like this.
If you have a server with SSH open to the internet, patch it NOW. Check it's version, if ssh is between version 4.4p1 and 8.5p1 then you are safe, outside of that patch it right away. If you can't patch it, set LoginGraceTime to 0. This could mean a DDOS but better that then pwnd
OpenSSH bug: yes, it takes forever to exploit against a single host. But you're mostly waiting for a timeout, so you can massively parallelize across internet targets w/o needing a botnet. Assume that this - and not targeted exploitation - is going to be the initial approach.
Pointers on CVE-2024-6387: * Affects OpenSSH 6.2 - 8.8 -> glibc-based Linux * Only x86 POC available * ASLR makes it hard for x64 POC * Upgrade to OpenSSH version 8.9 or later. * Race condition takes a lot of retries - check for multiple exploit attempts on ssh port and block IPs
the security bug for #OpenSSH is both rare for it and pretty interesting: https://blog.qualys.com/... and the technical details in https://www.qualys.com/... also, “watch your logs!” — I have a bias here but I have a preference for watching SSH / auth logs 😅
This OpenSSH RCE advisory is a classic example of hacker craftsmanship, generosity of spirit, & community contribution - a regression of duke's 2006 vuln, inspiration from @lcamtuf's 2001 paper, etc. The legacy of @Qualys' hacker founder @philpraxis continues! 🫡 #hackerhistory [i…
Hi @qualys has it occurred to you that this may not be the best acronym for a cybersecurity product? That it's actually a really bad one, even? [image]
I'll just retweet that. Nice job on OpenSSH. Truth to be told, Qualys might be the only group still regularly doing this kind of “basic stack” research. Almost all the vuln research has shifted elsewhere, largely in response to financial incentives.
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named “regreSSHion.” This Remote Code Execution bug grants full root access, posing a significant exploitation risk. https://blog.qualys.com/…