CVE-2026-35414


Knowledge Base • Security Advisory

CVE-2026-35414: OpenSSH Vulnerability & Required Incremental Fix for WTI Platforms

WTI Console v8.10 and Power v4.06 provide the required platform baseline, but this issue is not resolved by firmware alone. A required incremental upgrade to OpenSSH 10.3 must also be applied to fully mitigate CVE-2026-35414.

⚠️
Important
Upgrading to Console v8.10 or Power v4.06 by itself does not resolve CVE-2026-35414. The incremental OpenSSH 10.3 upgrade must also be installed.

Overview

CVE-2026-35414 affects systems running older versions of OpenSSH and introduces a flaw in how SSH certificate authentication is processed.

While WTI Console v8.10 and Power v4.06 provide the platform baseline for remediation, this vulnerability is not resolved by firmware alone. A required incremental upgrade to OpenSSH 10.3 must be applied to fully mitigate the issue.

Vulnerability Details

This issue exists in OpenSSH versions prior to 10.3.

Technical Summary
  • Improper handling of the authorized_keys principals option
  • Impacts certificate-based SSH authentication
  • Triggered by principals lists and comma-separated CA entries
  • Can result in incorrect authorization decisions

Security Impact

  • Potential for unauthorized SSH access
  • Authentication logic may incorrectly validate identities
  • Requires certificate-based authentication and a specific principals configuration
  • For environments not using SSH certificates, exposure is more limited, but remediation is still recommended

Affected Systems

  • Systems running OpenSSH versions earlier than 10.3
  • WTI systems on Console v8.10 or Power v4.06 without the incremental OpenSSH upgrade applied

WTI Mitigation Clarification

WTI provides the fix, but it must be explicitly applied.

Component Status
Console v8.10 / Power v4.06 Provides upgrade framework
OpenSSH (base firmware) Still vulnerable
Incremental OpenSSH upgrade (10.3) Required to remediate CVE-2026-35414

Incremental Upgrade Procedure (Required Step)

WTI systems support incremental upgrades, allowing targeted component updates such as OpenSSH without requiring a full firmware replacement.

Web (Method 2) and Local Upgrade (method 3) will require a manual reboot after installation of the incremental upgrade.  Note only a soft boot is required. Power to the plugs will remain in their current state. 

Method 1 — Direct via CLI (/ufw)

  1. Access the CLI
  2. Run:
/ufw
  1. Select Incremental Upgrade Options
  2. Review the available upgrade packages
  3. Select the appropriate OpenSSH 10.3 package
  4. Follow the on-screen prompts to complete the installation

Method 2 — Upgrade via WebGUI

  1. Log into the device Web interface at:
https://<ipaddress>
  1. In the left navigation pane, click Configuration, then select Firmware
  2. Click Choose File
  3. Select the downloaded incremental upgrade package
  4. Proceed with the upgrade
  5. Allow the upgrade to complete. The device may reboot after installation.
  6. Reboot the unit: Navigate to Configuration > General Parameters > Scripting Options > Reboot Unit

Method 3 — Local Upgrade (FTP/SFTP)

  • Supported on firmware v8.07 and above
  • Upload the incremental package manually via FTP or SFTP
  • Use /ufw to apply the uploaded upgrade
  • Follow the prompts to complete the installation
  • Reboot the unit: issue a "/i" and select reboot only.
ℹ️
Reference
WTI Incremental Upgrade Procedure:
https://wtiftp.wti.com/pub/TechSupport/Articles/Incremental_Upgrade_Procedure.pdf

Important Notes

  • Do not interrupt power during the upgrade
  • The device may reboot after installation
  • Ensure network access to WTI FTP if using the direct method

 

Recommended Actions

  • Apply the OpenSSH 10.3 incremental update as soon as possible
  • Review SSH settings if certificate-based authentication is in use
  • Maintain both firmware updates and incremental security patches as part of regular maintenance

 


Published on

Tags: