Skip to main

Vulnerabilities in BSH ELP Electronic Platforms

BOSCH-SA-943700

Advisory Information

  • Advisory ID: BOSCH-SA-943700
  • CVE Numbers and CVSS v3.1 Scores:
  • Published: 30 Jul 2026
  • Last Updated: 30 Jul 2026

Summary

Multiple vulnerabilities have been identified affecting the OpenSSH service configured within BSH ELP (Electronic Platform) modules. BSH Hausgeräte GmbH is a Bosch Group brand company. These modules are utilized across various connected home appliances (such as Bosch, Siemens, Gaggenau, and Neff).

The vulnerabilities include a critical signal handler race condition regression, commonly known as "regreSSHion" (CVE-2024-6387), along with historic and platform-specific logic issues. In a worst-case scenario, a successful exploitation of these vulnerabilities allows an unauthenticated, remote attacker to execute arbitrary code with root privileges on the appliance's underlying platform operating system.

Affected Products

  • Bosch BSH ELP (Electronic Platform) Modules
    • CVE-2006-5051
      • Version(s): 65.0.0 < 65.2.10
    • CVE-2006-5051
      • Version(s): 7x.y.z < 72.0.0
    • CVE-2026-56428
      • Version(s): 65.0.0 < 65.2.12
    • CVE-2024-6387
      • Version(s): 65.0.0 < 65.2.10
    • CVE-2024-6387
      • Version(s): 7x.y.z < 72.0.0

Solution and Mitigations

Solution

BSH Hausgeräte GmbH has released updated firmware versions that address these security flaws by patching or upgrading the embedded OpenSSH service. Users are strongly recommended to update their home appliance firmware.

Updates are generally delivered automatically via over-the-air (OTA) updates on internet-connected appliances, or they can be manually deployed by authorized service technicians using official service applications (such as the iService tool).

* For systems on the `65.x.y` branch, upgrade to 65.2.12 or higher (this fully mitigates all three listed CVEs).

* for systems on the `7x.y.z` branch, upgrade to 72.0.0 or higher.

Mitigation

If an immediate firmware update is not feasible, the following temporary workarounds should be applied to minimize security exposure:

1. Network Segmentation & Isolation: Ensure that connected appliances are on a secure home network behind a firewalled router. Do not expose the appliance's network services or port 22/TCP directly to untrusted public networks or the internet.

2. Access Control: Restrict local network access to trusted devices only, mitigating potential lateral movement vectors. .

Vulnerability Details

CVE-2006-5051

CVE Description: A signal handler race condition in OpenSSH versions before 4.4 allows remote, unauthenticated attackers to trigger a denial of service (daemon crash) and potentially execute arbitrary code under specific conditions (especially if GSSAPI authentication is enabled) due to an unsafe double-free vulnerability.

CVE-2026-56428

CVE Description: The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.

CVE-2024-6387

CVE Description: A security regression of CVE-2006-5051 was discovered in OpenSSH's server daemon (`sshd`). A race condition exists where, if a client fails to complete authentication within the configured `LoginGraceTime` period (typically 120 seconds), the `SIGALRM` handler is called asynchronously. This handler executes various functions that are not async-signal-safe (such as `syslog()`), allowing an attacker to corrupt memory and execute arbitrary code with root privileges.

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.

Additional Resources

Revision History

  • 30 Jul 2026: Initial Publication

Appendix

We would like to thank Kamal Sentassi from S9S - Security Electronic Service for making Responsible Disclosure with us.