{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog.\nBender has analyzed the vulnerabilities and determined that the electrical safety of the devices is not affected. Exploitation on the EDGE500IP requires code execution on the device, which is not available to users. Bender nevertheless considers the vulnerabilities to be of medium risk and has fixed them in COMTRAXX firmware 5.1.1.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker who is already able to execute code locally on the device could use the vulnerabilities in the kernel TLS implementation (CVE-2025-39682) or the AF_ALG crypto socket interface (CVE-2025-39964) to compromise the confidentiality, integrity and availability of the device.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Restrict network access to the device to trusted networks and users, and do not install firmware from untrusted sources.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Install COMTRAXX firmware 5.1.1 or later (https://www.bender.de/service-support/downloadbereich).",
        "title": "Remediation"
      },
      {
        "category": "description",
        "text": "The EDGE500IP is a COMTRAXX gateway for monitoring, visualizing and parameterizing Bender devices and integrating them into higher-level systems.",
        "title": "Product Description"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@bender.de",
      "name": "Bender GmbH & Co. KG",
      "namespace": "https://www.bender.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2026-143: Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG) - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-143/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-143: Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG) - CSAF",
        "url": "https://bender.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-143.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.bender.de"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Bender GmbH & Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/bender/"
      },
      {
        "category": "external",
        "summary": "CISA Known Exploited Vulnerabilities Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
      }
    ],
    "title": "Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)",
    "tracking": {
      "aliases": [
        "VDE-2026-143"
      ],
      "current_release_date": "2026-11-10T10:00:00.000Z",
      "generator": {
        "date": "2026-11-10T10:05:09.724Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-143",
      "initial_release_date": "2026-11-10T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-10T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "EDGE500IP",
                "product": {
                  "name": "EDGE500IP",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:bender:edge500ip:-:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "B95061250"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/>=5.0.0|<5.1.1",
                "product": {
                  "name": "COMTRAXX Firmware 5.0.0<5.1.1",
                  "product_id": "CSAFPID-21001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:bender:comtraxx_firmware:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5.1.1",
                "product": {
                  "name": "COMTRAXX Firmware 5.1.1",
                  "product_id": "CSAFPID-22001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:bender:comtraxx_firmware:5.1.1:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Bender"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.6.52",
                "product": {
                  "name": "Linux kernel 6.6.52",
                  "product_id": "CSAFPID-90001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:6.6.52:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Linux kernel"
          }
        ],
        "category": "vendor",
        "name": "Linux"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "COMTRAXX Firmware 5.0.0<5.1.1 installed on EDGE500IP",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:bender:edge500ip:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "COMTRAXX Firmware 5.1.1 installed on EDGE500IP",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:bender:edge500ip:5.1.1:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-39682",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.",
          "title": "CVE description"
        },
        {
          "audience": "operational management and system administrators",
          "category": "details",
          "text": "Kernel TLS support is part of the EDGE500IP kernel, but the vulnerable code is only reached if a process enables kernel TLS (TLS ULP) on a socket. No service on the EDGE500IP uses kernel TLS, and the TLS library on the device is built without kernel TLS support. Users have no local shell access to the device and secure boot ensures that only signed firmware runs on the device. An attacker would first have to gain code execution in one of the services on the device, some of which run in unprivileged containers. Assuming the worst case that such an attacker enables kernel TLS on a socket, the vulnerability could then be triggered over the network and used to escape the container and gain full control of the device. Bender therefore rates the vulnerability for the EDGE500IP with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 6.7",
          "title": "Vulnerability Characterisation"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-90001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-39682 record",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-39682"
        },
        {
          "category": "external",
          "summary": "Generic CVSS (NVD): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - 9.8 - Critical",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "CISA Known Exploited Vulnerabilities Catalog entry",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682"
        }
      ],
      "release_date": "2025-09-05T17:20:48.000Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed upstream in Linux kernel 6.6.103. For the EDGE500IP the fix is backported in COMTRAXX firmware 5.1.1.",
          "product_ids": [
            "CSAFPID-90001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to COMTRAXX firmware 5.1.1 or later.",
          "product_ids": [
            "CSAFPID-31001"
          ],
          "url": "https://www.bender.de/service-support/downloadbereich"
        },
        {
          "category": "mitigation",
          "details": "Restrict network access to the device to trusted networks and users, and do not install firmware from untrusted sources.",
          "product_ids": [
            "CSAFPID-31001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-90001"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001"
          ]
        }
      ],
      "title": "tls: fix handling of zero-length records on the rx_list"
    },
    {
      "cve": "CVE-2025-39964",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.",
          "title": "CVE description"
        },
        {
          "audience": "operational management and system administrators",
          "category": "details",
          "text": "The AF_ALG socket interface is only reachable by processes running locally on the device. On the EDGE500IP it is only used by an internal, sandboxed system service for hardware-backed cryptography. Users have no local shell access to the device and secure boot ensures that only signed firmware runs on the device. An attacker would first have to gain code execution in one of the services on the device, some of which run in unprivileged containers. Assuming the worst case that such an attacker can open an AF_ALG socket, the vulnerability could be used to escape the container and gain full control of the device. Bender therefore rates the vulnerability for the EDGE500IP with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\t6.7.",
          "title": "Vulnerability Characterisation"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-90001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-39964 record",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-39964"
        },
        {
          "category": "external",
          "summary": "Generic CVSS (CISA-ADP): CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - 7.8 - High",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "CISA Known Exploited Vulnerabilities Catalog entry",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
        }
      ],
      "release_date": "2025-10-13T13:48:30.000Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed upstream in Linux kernel 6.6.108. For the EDGE500IP the fix is backported in COMTRAXX firmware 5.1.1.",
          "product_ids": [
            "CSAFPID-90001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to COMTRAXX firmware 5.1.1 or later.",
          "product_ids": [
            "CSAFPID-31001"
          ],
          "url": "https://www.bender.de/service-support/downloadbereich"
        },
        {
          "category": "mitigation",
          "details": "Restrict network access to the device to trusted networks and users, and do not install firmware from untrusted sources.",
          "product_ids": [
            "CSAFPID-31001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-90001"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001"
          ]
        }
      ],
      "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg"
    }
  ]
}