Full Report
[Control Systems] Moxa security advisory (AV26-742)
Analysis Summary
# Vulnerability: ssh-keysign-pwn in Moxa Industrial Computing Platforms
## CVE Details
- **CVE ID:** CVE-2026-46333
- **CVSS Score:** Not explicitly listed in source (typically High for kernel-level privilege escalation)
- **CWE:** Not specified (Related to improper privilege management/buffer handling in kernel/OpenSSH components)
## Affected Systems
- **Products:**
- Moxa UC Series (Multiple models)
- Moxa V Series (Multiple models)
- Moxa VM-1220 Series
- Moxa ioThinx 4530 Series
- Moxa AIG Series
- Moxa BXP Series
- Moxa DRP-A100 / DRP-C100 Series
- Moxa RKP Series
- **Versions:**
- VM-1220: MIL3 v1.1.0 and prior
- ioThinx 4530: MIL3 v2.1 and prior
- DRP Series: Debian 11 V1.0
- Other Series: Multiple versions (refer to vendor advisory for specific model iterations)
- **Configurations:** Systems running affected Linux kernel versions with `ssh-keysign` enabled.
## Vulnerability Description
CVE-2026-46333, colloquially referred to as "ssh-keysign-pwn," is a vulnerability located within the Linux kernel components as utilized by OpenSSH’s `ssh-keysign` helper. The flaw typically involves a failure to properly sanitize or restrict operations within the setuid `ssh-keysign` utility, potentially allowing a local attacker to escalate privileges or manipulate sensitive cryptographic materials.
## Exploitation
- **Status:** Not specified as "exploited in the wild" in this bulletin; however, the naming convention suggests a known research-based Proof of Concept (PoC).
- **Complexity:** Medium
- **Attack Vector:** Local (Requires initial access to the device to execute the exploit)
## Impact
- **Confidentiality:** High (Potential access to private keys and sensitive system files)
- **Integrity:** High (Potential for unauthorized modification of system settings)
- **Availability:** High (Potential for system instability or denial of service via kernel-level manipulation)
## Remediation
### Patches
Moxa recommends updating to the latest firmware/OS versions provided in their security portal. Specific updated versions for MIL3 (Moxa Industrial Linux) and Debian-based builds are being released per-product line.
- **VM-1220:** Update beyond MIL3 v1.1.0.
- **ioThinx 4530:** Update beyond MIL3 v2.1.
### Workarounds
- Disable SSH if not required for industrial operations.
- Restrict Shell access to authorized users only to prevent local exploitation.
- Implement strict firewall rules to prevent unauthorized remote access that could lead to the local foothold necessary for this exploit.
## Detection
- **Indicators of compromise:** Unusual activity involving the `ssh-keysign` process or unexpected elevation of binary permissions.
- **Detection methods and tools:** Audit system logs for segment faults or crashes related to SSH services; utilize Integrity Measurement Architecture (IMA) to verify the state of system binaries.
## References
- **Vendor Advisory:** hxxps[://]www[.]moxa[.]com/en/support/product-support/security-advisory/mpsa-267410-cve-2026-46333-ssh-keysign-pwn-vulnerability-in-linux-kernel
- **Moxa Security Portal:** hxxps[://]www[.]moxa[.]com/en/support/product-support/security-advisory
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-742