As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.
Sign In
Home Support Security Advisories CVE-2026-46333: ssh-keysign-pwn Vulnerability in Linux Kernel

Product support

Security Advisories

Please sign in

Forgot your password?
Sign In
Remember Me.
Not a member? Sign up now
SUMMARY

CVE-2026-46333: ssh-keysign-pwn Vulnerability in Linux Kernel

This security advisory addresses a vulnerability identified in Linux Kernel.

CVE-2026-46333

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic. The vulnerability, known as **ssh-keysign-pwn**, allows an attacker who has obtained a regular user account to read and exfiltrate sensitive information, and to execute arbitrary commands with root privileges.

Given the high severity of the issue, users should apply the solutions immediately to reduce security risks.

 

The Identified Vulnerability Type and Potential Impact 

CVE ID Vulnerability Type Impact
CVE-2026-46333

CWE-269: Improper Privilege Management

 Local Privilege Escalation (root) 

Vulnerability Scoring Details 

CVE ID
Base Score
Vector
 Severity

Unauthenticated

Remote Exploits
CVE-2026-46333

CVSS 3.1: 7.1

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

 High No
AFFECTED PRODUCTS AND SOLUTIONS

Solutions

The table below lists all affected product series. Users should follow the solutions below to remediate affected systems.

PRODUCT SERIES

AFFECTED VERSIONS

SOLUTIONS

UC Series

  • UC-1200A Series

  • UC-2200A Series

  • UC-3400A Series

  • UC-4400A Series

  • UC-8600A Series

  • UC-8200 Series

  • UC-2100 Series
  • UC-3100 Series
  • UC-5100 Series
  • UC-8100 Series
  • UC-8100-ME Series
  • UC-8100A-ME Series
  • UC-8410A Series
  • UC-8540 Series
  • UC-8580 Series (EOL)
  • DA-662C-16-LX Series (GLB)

Moxa Industrial Linux (MIL)

  • MIL3 v1.4 and earlier, and MIL4 v1.0

  • MIL3 v1.4 and earlier, and MIL4 v1.0

  • MIL3 v1.2 and earlier, and MIL4 v1.0

  • MIL3 v1.3 and earlier, and MIL4 v1.0

  • MIL4 v1.1 and earlier

  • MIL3 v1.5 and earlier, and MIL1 v1.4 and earlier

  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.4 and earlier
  • MIL1 v1.3 and earlier
  • MIL1 v1.3 and earlier
  • MIL1 v1.4 and earlier

For products running MIL3 or MIL4: Please refer to Update Instructions - For MIL-based Products in Moxa's security advisory MPSA-263140 as the primary remediation step.

For products running MIL1: Firmware updates are not yet available. Please refer to the Mitigations section as an interim remediation step. This advisory will be updated once MIL1 firmware updates become available.

For additional support, please contact Moxa Technical Support.

V Series

  • V1200 Series

  • V3200 Series

  • V3400 Series

Moxa Industrial Linux (MIL)

  • MIL3 v1.2.0 and earlier

  • MIL3 v1.1 and earlier

  • MIL3 v1.1 and earlier

VM Series

  • VM-1220 Series

Moxa Industrial Linux (MIL)

  • MIL3 v1.1.0 and earlier

IoThinx Series

  • ioThinx 4530 Series

Moxa Industrial Linux (MIL)

  • MIL3 v2.1 and earlier

AIG Series

  • AIG-301 Series

  • AIG-302 Series

  • AIG-501 Series

  • AIG-502 Series

Firmware

  • MIL1 v1.4 and earlier

  • MIL3 v1.4.0 and earlier

  • MIL1 v1.5.0 and earlier

  • MIL3 v1.0.0

BXP Series

  • BXP-A100 Series

  • BXP-A101 Series

  • BXP-C100 Series

Debian ordered via CTOS

  • Debian 11 V1.0

  • Debian 12 V1.0

 

Please refer to Update Instructions - For Debian-based Products in Moxa's security advisory MPSA-263140 as the primary remediation step.

For upstream security information, please refer to Debian Security Advisories.

DRP Series

  • DRP-A100 Series

  • DRP-C100 Series

Debian ordered via CTOS

  • Debian 11 V1.0

RKP Series

  • RKP-A110 Series

  • RKP-C110 Series

  • RKP-C220 Series

Debian ordered via CTOS

  • Debian 11 V1.0

  • Debian 12 V1.0

 

Mitigations

For users who may not be able to perform am update, we provide the following recommended measures as alternatives to mitigate the risk associated with this vulnerability.

Follow the steps with root privilege.

Step 1. Back up SUID/SGID permissions

stat --format="%a %U %G %n" \

/usr/lib/openssh/ssh-keysign \

/usr/bin/chage \

> /root/suid_backup_$(date +%Y%m%d).txt

Step 2. Remove SUID/SGID bits

chmod u-s /usr/lib/openssh/ssh-keysign

chmod g-s /usr/bin/chage

Step 3. Persist permission overrides across package updates and reinstallations

dpkg-statoverride --add root root 0755 /usr/lib/openssh/ssh-keysign

dpkg-statoverride --add root shadow 0750 /usr/bin/chage

IMPACT

Mitigations Impact
Remove SUID from ssh-keysign Non-root users will fail authentication on systems with host-based authentication (HostbasedAuthentication is set to yes in the SSH server or client configuration).
Remove SGID from chage Normal users cannot view or manage their own password aging information (e.g., expiry date, warning period).

 

Mitigation Removal

Follow the steps with root privilege.

Step 1. Restore SUID/SGID bits

chmod u+s /usr/lib/openssh/ssh-keysign

chmod g+s /usr/bin/chage

Step 2. Remove dpkg-statoverride entries

dpkg-statoverride --remove /usr/lib/openssh/ssh-keysign

dpkg-statoverride --remove /usr/bin/chage

 

General Security Recommendations

To safeguard devices and networks, we recommend implementing the following recommendations to mitigate potential risks:

  1. Restrict network access.

    • Use firewalls or access control lists (ACLs) to limit communication to trusted IP addresses and networks.

    • Segregate operational networks from other networks (e.g., enterprise networks) using VLANs or physical separation.

  2. Minimize exposure.

    • Avoid exposing devices directly to the Internet.

    • Disable unused network services and ports to reduce the attack surface.

  3. Enhance device authentication and access control.

    • Implement multi-factor authentication (MFA) for accessing critical systems.

    • Use role-based access control (RBAC) to enforce the principle of least privilege.

    • Prohibit the use of weak passwords and enforce a password policy that includes password complexity requirements, periodic password changes, and restrictions on password reuse.

  4. Regularly update firmware and software.

    • Keep devices updated with the latest firmware versions and security patches.

    • Establish a regular patch management schedule to address newly identified vulnerabilities.

  5. Secure remote access.

    • Use encrypted communication protocols (e.g., VPN, SSH) for remote access.

    • Restrict remote access to authorized personnel only and enforce strong authentication mechanisms.

  6. Implement anomaly detection techniques.

    • Monitor network traffic and device behavior for unusual or unauthorized activities.

    • Use tools or techniques that can identify anomalies and provide alerts for potential threats.

  7. Implement logging and monitoring.

    • Enable event logging and maintain audit trails on devices.

    • Regularly review logs for anomalies and unauthorized access attempts.

  8. Conduct regular security assessments.

    • Perform vulnerability assessments to identify potential risks.

    • Regularly review device configurations to ensure compliance with security policies.

 

Revision History

VERSION

DESCRIPTION

RELEASE DATE

1.0

First release

July 24, 2026

Relevant Products

UC-1200A Series · UC-2200A Series · UC-3400A Series · UC-4400A Series · UC-8200 Series · UC-8600A Series ·

  •   Print this page

  • Save
    You can manage and share your saved list in My Moxa
Related Advisories
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
 
 
Added To Bag

View Bag
You have some items waiting in your bag; click here to finish your quote!

You are currently on the Global / English site.
Would you like to go to the site for your region?

Feedback