This article provides information on how to mitigate the CVE-2025-32728 vulnerability.

→ Applies to: SynetoOS 4.x

Vulnerability description

In sshd in OpenSSH before version 10.0, the DisableForwarding directive does not comply with the documentation stating it should disable both X11 forwarding and agent forwarding.

SOURCES
NIST (https://nvd.nist.gov/vuln/detail/CVE-2025-32728)

Mitigation

Disable X11 forwarding and agent forwarding in the SSH configuration on SynetoOS.

Step 1. Connect to SynetoOS appliance via SSH as admin

ssh admin@<your_ip_address_or_hostname>

Step 2 (optional). Change into Solaris shell (in case you're directed to an unsupported shell)

un sh

Step 3. Get root privileges

sudo su -

Step 4. Remove bash_profile

rm ~admin/.bash_profile

After running the command, you need to perform logout and login again.

Step 5. Edit /etc/ssh/sshd_config file

vi /etc/ssh/sshd_config

IMPORTANT
Make sure to copy and paste the exact lines below.

X11Forwarding no
AllowAgentForwarding no
PermitTTY yes

Add this line above AllowGroups synadmin staff at the end of the file

Step 6. Save /etc/ssh/sshd_config file

ESC

:WQ

Step 7. Restart svc:/network/ssh:default service

svcadm restart svc:/network/ssh:default

Step 8. Check the config

sshd -T | grep -E "x11forwarding|allowagentforwarding"

EXAMPLE OUTPUT

x11forwarding no
allowagentforwarding no