What’s Vulnerable › Vulnerabilities

CVE-2019-17584

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-21 · updated 2026-06-17

Description

The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions up to v5.34o, v5.34s, v5.32* or 5.34g are affected. The private key is also used in an internal interface of another Meinberg Device and can be extracted from a firmware update of this device. An update to fix the vulnerability was published by the vendor.

Affected products

• Meinbergglobal Syncbox/Ptpv2 Firmware: before 5.34o; before 5.34s; before 5.32; before 5.34g — fixed in 5.32, 5.34g, 5.34o, 5.34s

How to fix

Upgrade to a fixed version: Meinbergglobal Syncbox/Ptpv2 Firmware 5.32, 5.34g, 5.34o, 5.34s. Check the vendor advisory for mitigations.

References

• https://w1n73r.de/CVE/2019/17584/
• https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1904-syncbox-ptp-ptpv2.htm
• https://w1n73r.de/CVE/2019/17584/
• https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1904-syncbox-ptp-ptpv2.htm

Get alerted when CVE-2019-17584 or the next vulnerability affects your stack