CVE-2026-56428

Executive Summary

CVE-2026-56428 exposes a critical design flaw in BSH ELP (Electronic Platform) modules used in smart home appliances. The SSH service ships with a hardcoded, non-revocable root SSH public key in authorized_keys. An attacker in possession of the corresponding private key can gain unauthenticated root-level access over the network. With a CVSS v3.1 base score of 8.1, this vulnerability enables full host compromise, data exfiltration, and lateral movement within the IoT environment. No patch or advisory has been released by BSH as of this report; the vendor has not acknowledged the issue.

This is not a web application or WordPress vulnerability; it is a platform‑level embedded system weakness.

CVSS Breakdown & Threat Level

Threat Level: Critical. The lack of patch and public availability of the private key (potentially extracted from firmware) makes every BSH ELP module a target.

Deep Dive & Mechanics

BSH ELP modules run a stripped Linux environment with SSH server (likely Dropbear or OpenSSH). The firmware includes a statically placed /root/.ssh/authorized_keys containing a single public key baked in during manufacture. This key:

• Is identical across all units of the same product line (no per‑device key).
• Cannot be removed or rotated by the user – there is no configuration interface for SSH keys.
• Persists even after factory reset (firmware image is read‑only in many implementations).

An attacker who obtains the private key (for example, by extracting it from a firmware dump, reverse‑engineering a mobile app that embeds it, or purchasing it from a leak) can SSH directly as root without a password.

The vulnerability is classified under CWE-798: Use of Hard‑coded Credentials. The MITRE ATT&CK tactic is T1078.001 – Valid Accounts: Default Accounts.

Vulnerable vs. Patched Code

No patched firmware exists. Analysis of the vulnerable code path:

Vulnerable (firmware image):

# /root/.ssh/authorized_keys (present in all units)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... root@bsh-elp

• Key is loaded by SSH server at each connection.
• No mechanism to disable or override.

Hypothetical patch (not released):

# Instead, generate unique host key and authorized_keys per device at first boot
# Allow user to upload their own key via a secure web interface

Since no official patch exists, the only mitigation is to disable SSH entirely (e.g., via firewall rules) or replace the firmware with a custom build if possible.

Exploitation & Lab Setup

Red Team

1. Reconnaissance – Shodan search for BSH ELP or banners showing SSH-2.0-dropbear_2022.83. Alternatively, scan port 22 and attempt to identify BSH devices via SSH banner.
2. Obtain the private key – Extract from a firmware dump (e.g., using binwalk on a BSH firmware update file). The private key is often embedded in the same image or in companion mobile apps.
3. Exploit command:

   ssh -i bsh_private_key root@<target_ip>
   

   No password prompt; immediate root shell.
4. Post‑exploitation – Harvest stored Wi‑Fi credentials, modify appliance behavior, install persistent backdoor, pivot to other IoT devices.

Blue Team

• Monitor inbound SSH connections to ELP devices. Alert on any successful root login.
• Block SSH access from the internet (unless absolutely required) using ACL or firewall rules.
• If possible, replace the stock firmware with a hardened version that generates unique keys.
• Log all SSH authentication attempts – look for Accepted publickey with the known hardcoded key fingerprint.

Lab Environment Setup:

• Emulate BSH ELP using QEMU with a dumped firmware image.
• Connect with the extracted private key.
• Verify root shell access.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_56428_BSH_ELP_SSH_Key
{
    meta:
        description = "Detect BSH ELP firmware containing hardcoded SSH public key"
        author = "Valters IT"
        reference = "CVE-2026-56428"
        hash = "f9a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6"
    strings:
        $ssh_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ" ascii wide
        $authorized_path = "/root/.ssh/authorized_keys" ascii
    condition:
        $ssh_key and $authorized_path
}

Sigma Rule

title: SSH Root Login via Hardcoded Key on BSH ELP
id: 9a8b7c6d-5e4f-3a2b-1c0d-e9f8a7b6c5d4
status: experimental
description: Detects successful root SSH authentication using a known hardcoded public key on BSH Electronic Platform modules.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56428
author: Valters IT
logsource:
    product: linux
    service: sshd
detection:
    selection:
        EventID: 'SSH_AUTH_SUCCESS'
        Username: 'root'
        AuthMethod: 'publickey'
        Fingerprint: 'SHA256:AbCdEfGhIjKlMnOpQrStUvWxYz1234567890'  # Replace with actual fingerprint
    condition: selection
falsepositives:
    - Authorized administrative access (if allowed)
level: high
tags:
    - attack.t1078.001
    - cve.2026-56428

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2026-56428 BSH ELP Hardcoded SSH Key Login"; flow:to_server,established; content:"SSH-2.0-dropbear_2022.83"; fast_pattern; sid:202656428; rev:1;)

Remediation & Mitigation

• Immediate: Restrict SSH access to only trusted management networks using firewall rules. Disable port forwarding to the internet.
• Short‑term: Deploy network‑based intrusion detection using the above rules to detect exploitation attempts.
• Long‑term: Contact BSH to demand a firmware update that replaces the hardcoded key with a device‑unique, user‑configurable key. If no patch is forthcoming, consider replacing the ELP module with a secure alternative.
• Compensating controls: Implement SSH key rotation scripts (if device allows) or use a jump host with strong authentication.
• Monitor: Continuously log and alert on any root SSH sessions from unexpected IPs.

Valters IT Signature Report generated by Valters IT Cyber Threat Intelligence Division – CVE-2026-56428 Analysis