Security advisories
- Vulnerability in the Linux kernel of Behnke Station and Behnke ControlCenter (CVE-2026-98432)
- ID
- BEHNKE-SA-2026-0003
- Product
- Behnke ControlCenter — affected 1.0.494577, 1.0.494723, 1.0.497435, 1.0.497965, 1.0.491941, fixed in 1.0.498277
- Product
- Behnke Station — affected 6.56, 3.00, 4.00, 6.81, 3.74, 5.91, 3.63, 2.90, 5.15, 6.33, 5.26, 6.80, 6.12, fixed in 6.83
A vulnerability (CVE-2026-98432) has been identified in the networking code of the Linux kernel used by Behnke Station and Behnke ControlCenter. When a TCP connection is established over IPv4, IP options can be freed while the kernel still accesses them (use-after-free). An attacker who can send specially crafted network packets to the device may, in the worst case, read information, corrupt memory or crash the device.
Affected are Behnke Station firmware versions before 6.83 and Behnke ControlCenter versions before 1.0.498277.
An attack requires that TCP packets with IPv4 options reach the device and that a timing-dependent race condition is won. Many networks already drop such packets. If the devices are not operated directly reachable from the internet, the risk is significantly lower. An attack from the local network remains possible, however. No active exploitation is currently known.
Remedy
Update Behnke Station to firmware version 6.83 or later and Behnke ControlCenter to version 1.0.498277 or later.
If an immediate update is not possible:
- Operate the devices only in segregated networks that are not directly reachable from the internet.
- Configure your firewall to drop IPv4 packets with IP options addressed to the devices.
- Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- ID
- BEHNKE-SA-2026-0002
- Product
- Behnke Station — affected 6.56, 3.00, 4.00, 3.74, 5.91, 3.63, 2.90, 5.15, 6.33, 5.26, 6.12, fixed in 6.80
The Behnke-Station up to version 6.56 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.
Public proof-of-concept exploits exist, and exploitation attempts against internet-facing PHP installations have been reported. We are not aware of any exploitation of the Behnke-Station at the time of publication.
Remedy
Update to version 6.80 or later. Until then, do not expose the web interface to the internet.