Select Page

Hillstone StoneOS Series Products Not Affected by OpenSSH Password Authentication Bypass Vulnerability (CVE-2026-123158)

by | Nov 5, 2026

Advisory IDSeverityRelease DateReported ByCVE ID
N/AHighNovember 6, 2026CVECVE-2026-123158

Overview

OpenSSH has released a security update fixing a password authentication bypass vulnerability (CVE-2026-123158, CVSS 3.1 score 8.1). The crypt() function of musl libc returns the string “*” instead of NULL when password hashing fails; combined with OpenSSH’s password authentication logic, this allows an attacker to bypass password authentication and log in to target accounts, including locked accounts, by submitting an excessively long password of more than 256 bytes.

Exploiting this vulnerability requires all of the following conditions: (1) OpenSSH version below 10.6p2 (10.6p1 and earlier); (2) the system uses musl libc (typically embedded environments such as Alpine Linux, Buildroot, OpenWrt, and Yocto); and (3) sshd does not use PAM authentication and directly calls musl libc’s crypt() for password verification.

Systems using glibc and environments with PAM authentication enabled are not affected by this vulnerability. Upon investigation, the operating systems of Hillstone StoneOS series products are all based on glibc, and the products do not use OpenSSH’s password authentication logic; therefore, they do not meet the exploitation conditions and are not affected by this vulnerability.

Affected Products & Fix Versions

ProductAffected VersionFixed Version
NGFWAll versions are not affectedNo fix required
WAFAll versions are not affectedNo fix required
NIPS/NIDSAll versions are not affectedNo fix required
ADCAll versions are not affectedNo fix required
BDSAll versions are not affectedNo fix required
CloudHiveAll versions are not affectedNo fix required
LMSAll versions are not affectedNo fix required

Remediation & Mitigation

  • Hillstone StoneOS series products are not affected by this vulnerability and no upgrade is required. If customers run OpenSSH services on systems other than Hillstone products (e.g., musl libc environments such as Alpine Linux), it is recommended to upgrade OpenSSH to 10.6p2 or later per the official OpenSSH advisory, or enable PAM authentication.

Contact & Reporting

For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.

To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.

Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.