Don't be an SSHole: Block SSH into the Lower Levels of OT and Patch What Must Stay Exposed

The Red Tiger team is advising asset owners that SSH is the maintenance door into the heart of the plant. Engineers and vendors use it to reach controllers, remote terminal units (RTUs), human-machine interfaces (HMIs) and gateways at Purdue Levels 0 to 2. The problem is that OEM vendors often ship old OpenSSH, Dropbear or libssh builds inside that firmware, and those builds can stay in a plant for ten years or more.

This is not theory. Three published examples:
- regreSSHion, CVE-2024-6387 (OpenSSH): Siemens SSA-446545 lists SINUMERIK ONE, SINEMA Remote Connect Server, the SINAMICS IIoT module and Industrial Edge Management OS.
- Terrapin, CVE-2023-48795 (SSH handshake): Moxa MPSA-247816 lists ten UC series industrial computers, and Siemens lists the RUGGEDCOM APE1808 (CISA ICSA-24-193-11).
- New this week: OpenSSH 10.6p2 (5 November) fixes a password authentication bypass in sshd on musl Linux without the Pluggable Authentication Module (PAM), such as Alpine. Alpine has fixed packages back to 3.16. No CVE yet. Buildroot, Yocto and OpenWrt builds, common in embedded gear, can meet the same conditions, so ask your vendors.

What the Red Tiger team recommends:
1. Block SSH from Level 3 and above into Levels 0 to 2. No direct SSH to field devices from the business network or the internet.
2. Where SSH has to stay, patch it or get fixed firmware from the vendor, and turn off password logins where the device allows it.
3. Route all SSH through a hardened jump host in the OT demilitarized zone (DMZ), with multifactor authentication (MFA), approved source addresses only, and session logging and monitoring.
4. Inventory SSH versions on every device, and ask each vendor for a software bill of materials (SBOM) that names the SSH library and version.

NIST SP 800-82r3 and the CISA guidance on secure remote access to OT say the same thing: one controlled, monitored path in, nothing direct to the controllers.

Red Tiger Security has completed 500+ plant-safe operational technology (OT) assessments and trained 4,500+ engineers and operators.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: https://cert-portal.siemens.com/productcert/html/ssa-446545.html | https://www.moxa.com/en/support/product-support/security-advisory/mpsa-247816-multiple-uc-series-ipc-ssh-vulnerability | https://www.openssh.com/releasenotes.html | https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ | https://csrc.nist.gov/pubs/sp/800/82/r3/final

Published SSH flaws in OT vendor products

regreSSHion, CVE-2024-6387 (CVSS 8.1) — OpenSSH sshd — Siemens SSA-446545 and CISA ICSA-24-256-15 — SINUMERIK ONE below V6.24; SINEMA Remote Connect Server below V3.2 SP2; SINAMICS IIoT module below V1.0 HF1; Industrial Edge Management OS (all) — Update to listed versions; IEM-OS no fix planned, limit SSH to trusted systems or disable it.

Terrapin, CVE-2023-48795 (CVSS 5.9) — SSH protocol handshake — Moxa MPSA-247816 — UC-2100, UC-3100, UC-5100, UC-8100, UC-8100-ME-T, UC-8100A-ME-T, UC-8200, UC-8410A, UC-8540, UC-8580 series — Upgrade to the firmware listed per series.

Terrapin, CVE-2023-48795 — SSH in PAN-OS virtual firewall on the platform — Siemens via CISA ICSA-24-193-11 — RUGGEDCOM APE1808 (all versions) — No fix; configure SSH profile to remove ChaCha20-Poly1305 and Encrypt-then-MAC.

OpenSSH musl/no-PAM password authentication bypass (no CVE assigned) — OpenSSH sshd on musl Linux without PAM — Alpine advisory and OpenSSH 10.6p2 notes — Alpine openssh-server 3.16 through edge; other musl builds without PAM may meet the same conditions. No OT vendor bulletin yet — OpenSSH 10.6p2 / Alpine fixed packages; until then PasswordAuthentication no.

Dropbear and libssh: no OT-vendor advisory naming a current Dropbear or libssh flaw was verified for this draft, so none is listed. Ask vendors through the SBOM request.

Guidance sources: NIST SP 800-82r3; CISA Internet Exposure Reduction Guidance; CISA Primary Mitigations to Reduce Cyber Threats to OT; CISA and partners, Adapting Zero Trust Principles to OT; CISA/NCSC-UK Secure Connectivity Principles for OT.

‍