SplitSSHell OpenSSH command injection (CVE-2026-35414)

Summary

Certain certificate principal lists may be interpreted incorrectly.

Vulnerability ID	Vulnerability Overview
CVE-2026-35414	OpenSSH fails to sanitize specific split-string inputs within Match block configurations. An authenticated attacker can leverage this parsing flaw to inject and execute arbitrary commands on the server.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16

 

Back to Security Notices

Date	Description
09/02/2026	Initial release
10/14/2026	Update

Back to Security Notices