NetApp Black Box — ONTAP knowledge base

Home / Security / Advisories / NTAP-20240712-0003

NTAP-20240712-0003 — CVE-2024-6409 OpenSSH Vulnerability in NetApp Products

Published 2024-07-12 · Updated 2026-07-08 · Status: Interim · Exploitation: Public · Severity: HIGH 7.0 · ONTAP affected: Yes

Official advisory: NTAP-20240712-0003 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Baseboard management controllers · Active IQ Unified Manager · SolidFire / NetApp HCI · ONTAP  |  ONTAP-relevant  |  highest CVSS: 7.0

CVEs in this advisory

What the CVE records say

CVE-2024-6409 — A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).

Affected products

Official fixes

What to do

  1. Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
  2. If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
  3. If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
  4. Harden in parallel: security hardening baseline and ransomware protection on ONTAP.

Related reading

Browse all ONTAP CVEs → · Security hub