What it is
CVE-2024-6387 is an unauthenticated vulnerability affecting Red Hat Red Hat Enterprise Linux 9 and 14 other products. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race...
Vulnerability report
CVE-2024-6387
Red Hat Enterprise Linux 9 Remote Code Execution
Red Hat / Red Hat Enterprise Linux 9 · affected before *
- Severity
- CVSS 8.1 · High
- Confidence
- —
- Exploit status
- —
- EPSS
- —
- First observed
- —
- Last observed
- —
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
No. Previdian has not recorded active exploitation signals yet.
Who is affected?
Red Hat / Red Hat Enterprise Linux 9 affected before *.
What should we do?
Track for updates. Assess relevance to your asset inventory and enrichment workflows.
Overview
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner.
An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Vendor
Product
Affected
Status
Siemens
Affected
Industrial Edge Management OS (IEM-OS)
Before *
Affected
Siemens
Affected
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Before *
Affected
Siemens
Affected
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Before *
Affected
Siemens
Affected
SINAMICS IIoT module
Before V1.0 HF1
Affected
Siemens
Affected
SINEMA Remote Connect Server
Before V3.2 SP2
Affected
Siemens
Affected
SINUMERIK ONE
Before V6.24
Affected
Siemens
Affected
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Before *
Affected
Red Hat
Unaffected
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
openssh
Before *
Unaffected
Red Hat
Unaffected
Red Hat Enterprise Linux 10
openssh
All versions (default: unaffected)
Unaffected
Red Hat
Affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
All versions (default: affected)
Affected
- Published
- 01 Jul 2024
- Exploitation date
- —
- Attack vector
- Remote
- Complexity
- High
- Privileges
- None
- User interaction
- None
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2024-6387
- RHSA-2024:4312 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4312
- RHSA-2024:4340 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4340
- RHSA-2024:4389 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4389
- RHSA-2024:4469 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4469
- RHSA-2024:4474 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4474
- RHSA-2024:4479 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4479
- RHSA-2024:4484 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2024:4484
- RHBZ#2294604 bugzilla.redhat.com · Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2294604
- VDB Entry — access.redhat.com access.redhat.com · VDB Entry https://access.redhat.com/security/cve/CVE-2024-6387
- santandersecurityresearch.github.io/blog/sshing_the_masses.html santandersecurityresearch.github.io · CVE Record https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
- openssh.com/txt/release-9.8 openssh.com · CVE Record https://www.openssh.com/txt/release-9.8
- qualys.com/2024/07/01/cve-2024-6387/regresshion.txt qualys.com · CVE Record https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Exploitation evidence
Exploitation evidence for this CVE
Catalogues and sources that list this CVE as a known exploited vulnerability, when available.
No exploitation evidence rows are recorded for this CVE yet.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 0
- 0
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
Nessus template detected 03 Sep 2024.
View Nessus template (opens in new tab)Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →Scanner Artifacts
Scanner and exploit-framework references linked to this CVE.
| Scanner | Reference | Detected |
|---|---|---|
| Nessus | https://www.tenable.com/plugins/nessus/206464 | 03 Sep 2024 |
Risk and context
Severity, weaknesses, and research context
CVSS v3.1
8.1
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
—
Weaknesses
Timeline
From disclosure to today
-
15:23 UTC
Nessus plugin available
Scanner coverage available
-
12:37 UTC
CVE published
Vulnerability disclosed publicly
-
13:41 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2024-6387
Free JSON includes basic KEV fields{
"cve_id": "CVE-2024-6387",
"confidence": null,
"cvss_score": 8.1,
"cvss_estimated": false,
"epss_score": null,
"exploit_status": {
"exploited_in_the_wild": false,
"active_exploitation_observed": false
},
"sensor_telemetry": { "attempts": 0, "sensors": 0 }
}