OpenSSH Terrapin Attack

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2023-035 CVE-2023-48795 12/21/2023 medium v3

Vulnerability details

The version of OpenSSH used in SNS is susceptible to the Terrapin Attack.

Impacted products

Stormshield Network Security medium SNS is impacted


Version Date Description
v1 12/29/2023 Initial release
v2 01/02/2024 Update CVEs
v3 02/22/2024 Update firmware fixed versions list

Stormshield Network Security

CVSS v3.1 Overall Score: 6.4      


Impacted version

The Terrapin attack is a vulnerability in the SSH protocol itself. It results in the compromised client mistakenly perceiving that the server does not support recent signature algorithms used in user authentication. This vulnerability can be exploited through a man-in-the-middle (MitM) attack.

The vulnerability impacts all SSH connections and is specifically focused on the OpenSSH implementation. The vulnerable OpenSSH configurations are:

  • Any AES(128|192|256)-cbc ciphers
  • Any MACs that use Encrypt-then-MAC (EtM), such as hmac-(sha2-512|sha2-256|sha1|sha1-96|md5-96|md5) and umac-(128|64)

Note that : AES(128|192|256)-cbc ciphers, hmac-(sha1|sha1-96|md5-96|md5) and MACs are usually deactivated by default.

The risk associated with this vulnerability is mitigated if the deployment recommendations for SNS, as describe in the installation guide, have been respected.


  • All SNS versions

Workaround solution


It’s important to note that the default OpenSSH configurations is vulnerable to this attack because it allow the use of the ChaCha20-Poly1305 cipher. Mitigating this vulnerability involves disabling or removing these vulnerable configurations. Please follow these steps:

  • Open an SSH connection to the firewall.
  • Edit the file ConfigFiles/system.
    • In the [SSHCiphers] section, set the values to 0 for the following Ciphers:
      • CBC suites (aes128-cbc, aes192-cbc, and aes256-cbc).
    • In the [SSHMACs] section, set the values to 0 for the following MACs:
  • Once you’ve made these adjustments, reboot the SNS.

The following versions will fix this vulnerability:

  • SNS 4.7.4
  • SNS 4.6.11
  • SNS 4.3.24
  • SNS 3.11.28
  • SNS 3.7.40


Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Adjacent Network High None None Unchanged High Low High
CVSS Base score: 7.1 CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H)
Exploit Code Maturity Remediation Level Report Confidence
Unproven that exploit exists Workaround Reasonable
CVSS Temporal score: 6.1 CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H/E:U/RL:W/RC:R)
Confidentiality Requirement Integrity Requirement Availability Requirement
High Low High
CVSS Environmental score: 6.4 CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H/E:U/RL:W/RC:R/CR:H/IR:L/AR:H/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X)