Perle IOLAN STS/SCS CVE-2026-23759

Upgrade all affected Perle IOLAN STS and SCS terminal servers to firmware version 6.0 or later, which contains vendor-released patches addressing the command injection vulnerability in the restricted shell's 'ps' command implementation. Firmware downloads and upgrade instructions are available from Perle Systems at https://www.perle.com/downloads/server_sds_sts_rackmount.shtml with device-specific procedures documented in the IOLAN SCS/SDS/STS User Guide at https://www.perle.com/support_services/documentation_pdfs/iolan_scs-sds-sts_ug.pdf. If immediate patching is not feasible, implement compensating controls including restricting network access to IOLAN management interfaces (Telnet/SSH) to dedicated out-of-band management networks with strict firewall rules allowing only trusted administrator IP addresses, enforcing strong authentication policies with complex passwords or certificate-based SSH authentication, disabling Telnet in favor of SSH-only access, implementing multi-factor authentication if supported by the environment, and establishing monitoring for unusual command patterns or failed authentication attempts. Note that network restrictions do not eliminate risk if attackers gain credentials through other means (phishing, credential reuse) but reduce attack surface. These workarounds should be considered temporary measures only, as the underlying code flaw remains exploitable by any authenticated user until firmware is upgraded.