Cisco switch need to Upgrade to OpenSSH version 9.8 or late

[Syed Akbar Ali]

Hi team,

Model : Cisco -C9200L-48P-4X , Version Cisco IOS XE Software, Version 17.12.03
Cisco IOS Software [Dublin], Catalyst L3 Switch Software (CAT9K_LITE_IOSXE), Version 17.12.3

Already SSH Enabled - version 2.0

while we scan Vulnerability give this output as Upgrade to OpenSSH version 9.8 or later.

Kindly advice.

[Flavio Miranda]

@Syed Akbar Ali 

This issue is describded on two CVEs

CVE-2024-39894 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39894
CVE-2024-6387 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387

Under the Bug ID CSCwm27472

Recommended fixed release is 17.15.2  and 17.16.1

[Syed Akbar Ali]

Hello Flavio Miranda,

Thanks for information

Recommended fixed release is 17.15.2 and 17.16.1 which are Early Deployment (ED). there should not be have any impact on the production device after upgrade .  and l have list of devices which have the Cisco IOS XE 17.9.4a , 17.9.5 and Cisco NX-OS version 8.4(X) what will be recommended fixed release.

[Flavio Miranda]

@Syed Akbar Ali 

 This bug is related to Catalyst device. I dont see any NX-OS on the list. 

For IOX-XE you need to move to 17.15 or 17.16. Unfortunatelly the impact is hard to say anything about it. But, if this is  really critical for your environment, you may dont have alternative.