SSH Enablement Signature Verification Bypass
Priority LOW 38CWE-347Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00111 1st percentileScored 2026-11-07
Fix Fixed c430 (Lenze): 1.15.2c520 (Lenze): 1.15.2+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenze | c430 | 1.0.0 to before 1.15.2 | 1.15.2 | Patch available | CNA |
| Lenze | c520 | 1.0.0 to before 1.15.2 | 1.15.2 | Patch available | CNA |
| Lenze | c550 | 1.0.0 to before 1.15.2 | 1.15.2 | Patch available | CNA |
| Lenze | i950 GenA | 1.0.0 to before 1.14.2 | 1.14.2 | Patch available | CNA |
| Lenze | i950 GenB | 2.0.0 to before 2.0.3 | 2.0.3 | Patch available | CNA |
- c430 VendorLenze Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available CNA
- c520 VendorLenze Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available CNA
- c550 VendorLenze Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available CNA
- i950 GenA VendorLenze Affected 1.0.0 to before 1.14.2 Fixed in 1.14.2 Patch available CNA
- i950 GenB VendorLenze Affected 2.0.0 to before 2.0.3 Fixed in 2.0.3 Patch available CNA
Remediation
- Fix · CNA c430 (Lenze) Fixed in 1.15.2
- Fix · CNA c520 (Lenze) Fixed in 1.15.2
- Fix · CNA c550 (Lenze) Fixed in 1.15.2
- Fix · CNA i950 GenA (Lenze) Fixed in 1.14.2
- Fix · CNA i950 GenB (Lenze) Fixed in 2.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14837
- 2026-10-03 Alias added: GHSA-fcw6-hwx8-wwx8
References
More Lenze vulnerabilities
- TI-2022-02125 LENZE: Missing password verification in authorisation procedure CVSS 3.1CRITICAL 9.8
- TI-2025-27613 Lenze: Plaintext Password Disclosure in PLC Designer V4 Interface CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-14837 · CVE Program
- CVE-2026-14837 · NVD
- FIRST EPSS
- GHSA-fcw6-hwx8-wwx8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences