{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/i950-genb--2.0.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-14837"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["c430 (\u003c 1.15.2)","c520 (\u003c 1.15.2)","c550 (\u003c 1.15.2)","i950 GenA (\u003c 1.14.2)","i950 GenB (\u003c 2.0.3)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ics","ot","industrial-control-system","ssh","signature-bypass"],"_cs_type":"advisory","_cs_vendors":["Lenze"],"content_html":"\u003cp\u003eCVE-2026-14837 describes an improper signature verification vulnerability affecting several Lenze industrial control system (ICS) products. This flaw is present in the SSH enablement mechanism across various models, including c430 (versions prior to 1.15.2), c520 (versions prior to 1.15.2), c550 (versions prior to 1.15.2), i950 GenA (versions prior to 1.14.2), and i950 GenB (versions prior to 2.0.3). A low-privileged local attacker with existing access to the device can exploit this vulnerability to bypass the cryptographic signature verification process for the SSH enable file. By doing so, the attacker can activate SSH access on the device, granting themselves unauthorized administrative control and potentially leading to full system compromise. This vulnerability poses a significant risk to the operational technology (OT) environments where these devices are deployed, as it can facilitate unauthorized changes, data exfiltration, or disruption of critical processes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial low-privileged local access to a vulnerable Lenze industrial control device.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious or modified SSH enable file designed to activate SSH services with unauthorized parameters.\u003c/li\u003e\n\u003cli\u003eAttacker leverages CVE-2026-14837 to bypass the device's cryptographic signature verification mechanism for the SSH enable file.\u003c/li\u003e\n\u003cli\u003eThe attacker deploys the crafted SSH enable file onto the device, which the system now falsely accepts as legitimate due to the signature bypass.\u003c/li\u003e\n\u003cli\u003eThe Lenze device processes the seemingly valid enable file, leading to the unauthorized activation of SSH services.\u003c/li\u003e\n\u003cli\u003eAttacker establishes an unauthorized administrative SSH session to the device.\u003c/li\u003e\n\u003cli\u003eAttacker gains complete administrative control over the compromised Lenze device, allowing for system configuration changes, arbitrary command execution, and potential disruption of industrial processes.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14837 leads to unauthorized administrative access and complete system compromise of affected Lenze devices. This can have severe consequences for industrial and critical infrastructure environments. Attackers gaining full control could manipulate operational parameters, disrupt production processes, cause equipment damage, or facilitate further lateral movement into other connected systems. The compromise could result in operational downtime, financial losses, safety incidents, and potential environmental damage, especially in sectors relying on these controllers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all affected Lenze products (c430, c520, c550, i950 GenA, i950 GenB) to the fixed versions provided by Lenze to remediate CVE-2026-14837.\u003c/li\u003e\n\u003cli\u003eRestrict local physical and network access to Lenze devices to only authorized personnel to mitigate the initial access vector required for CVE-2026-14837 exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor device logs for unauthorized SSH service activation or unusual activity originating from local accounts, which could indicate attempted exploitation of CVE-2026-14837 or post-exploitation activities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-27T08:18:16Z","date_published":"2026-07-27T08:18:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-lenze-cve-2026-14837/","summary":"A low-privileged local attacker can exploit CVE-2026-14837, an improper signature verification vulnerability, in multiple Lenze products including models c430, c520, c550, i950 GenA, and i950 GenB to bypass the verification of the SSH enable file signature, subsequently enabling SSH access on the affected device, resulting in unauthorized administrative access and complete system compromise.","title":"Improper Signature Verification in Lenze Products (CVE-2026-14837)","url":"https://feed.craftedsignal.io/briefs/2026-07-lenze-cve-2026-14837/"}],"language":"en","title":"CraftedSignal Threat Feed - I950 GenB (\u003c 2.0.3)","version":"https://jsonfeed.org/version/1.1"}