Main Vulnerability Database SB2025121166

SB2025121166 - IQ Engine update for OpenSSH

Published: December 11, 2025

Security Bulletin ID SB2025121166

Severity

High

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Race condition (CVE-ID: CVE-2024-6409)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in portable version of sshd when handling signals. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. A remote non-authenticated attacker can send a series of requests in order to trigger a race condition and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2025-100-openssh-sigalrm-in-privsep-cve-2024-6409/ba-p/120939"
https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2025-100-openssh-sigalrm-in-privsep-cve-2024-6409/ba-p/120939</a>
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130864