# Tripp Lite B093 vs Opengear firmware: kernel, CVEs and features

> Why you'd move a Tripp Lite B093 console server to Opengear ACM700x firmware at all, and what you'd gain and give up - kernel, crypto libraries, CVEs fixed since Tripp Lite's last release, and features.

- Source: https://bytesizedtechsolutions.com/articles/tripp-lite-b093-why-opengear-firmware/
- Author: Craig Miller
- Published: 2026-11-07
- Tags: console servers, firmware, security, embedded linux, opengear, tripp lite
- License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

> **Warning: Proceed at your own risk.** This series is about loading another vendor's firmware onto a Tripp Lite B093 console server. Neither Tripp Lite (Eaton) nor Opengear supports this, and it may void your warranty and your support entitlement.
>
> A failed or interrupted write can leave the unit unable to boot until someone recovers it in person over a serial console cable. A mistake can also erase its configuration.
>
> Everything here was done on one unit in my own lab. Your hardware, model or firmware may behave differently. Back up the configuration first, keep serial console access, and don't try it on a unit you depend on or can't physically reach.
>
> You're responsible for making sure you're licensed to use any firmware you install. This is shared as is, without warranty, and it isn't vendor guidance. You act on it at your own risk, and I accept no liability for damage, downtime or data loss.

**Tripp Lite B093 cross-flash series** (part 1 of 3)

- Overview: [Cross-flashing Tripp Lite B093 console servers to Opengear firmware](https://bytesizedtechsolutions.com/projects/tripp-lite-b093-crossflash/)
- Part 1: Tripp Lite B093 vs Opengear firmware: kernel, CVEs and features (this page)
- Part 2: [Why netflash looked like it bricked my Tripp Lite B093: the -C flag only compares](https://bytesizedtechsolutions.com/articles/tripp-lite-b093-netflash-compare-only/)
- Part 3: [Tripp Lite B093 boot and recovery: no A/B fallback, a watchdog and the ERASE button](https://bytesizedtechsolutions.com/articles/tripp-lite-b093-boot-and-recovery/)

## What the B093 is, and why its firmware matters

The Tripp Lite (now Eaton) **B093** is a small serial console server: a few RJ45 serial ports, dual gigabit Ethernet, USB, and on some models a 4G LTE modem for out-of-band access. You rack one so that when a firewall, switch or router is broken, you can still reach its console.

Under the badge it's Opengear **ACM7000-family** hardware running a rebranded build of Opengear's firmware. That shared lineage is what makes a cross-flash possible. It's also why the firmware gap matters. A console server is the device you reach when everything else is down, often over a cellular link, and it holds the keys to every console it's cabled to. It should be running a current, patched operating system.

## The short answer

The newest B093 firmware I could find publicly is Tripp Lite **4.10.0**, built in December 2020. It lines up with Opengear's own 4.10.0 release from the same month. Opengear has kept releasing for the same hardware since then, through **5.5.3** in October 2026.

The case for moving is mostly **security, not features**. The Tripp Lite build's crypto and remote-access stack is 8 to 18 years old, and several of its components are end-of-life upstream.

| Component | Tripp Lite 4.10.0 | Opengear 5.5.x |
| --- | --- | --- |
| Linux kernel | 3.10.0 (gcc 4.8.1) | 5.17.0 (gcc 11.2) |
| C library | uClibc 0.9.33 | musl 1.2.2 |
| OpenSSL | 1.0.1u (2016, end-of-life) | 3.1.8, with TLS 1.3 |
| OpenSSH | 7.7p1 | 10.4p1 to 10.6p1 |
| IPsec | Openswan 2.6.37 (project discontinued) | strongSwan 5.9.12 to 6.1.0, with IKEv2 |
| OpenVPN | 2.4.6 | 2.6.21 |
| libcurl | 7.19.0 (2008) | 8.4.0 |
| BusyBox | 1.10.2 (2008) | 1.36.1 |
| sudo | 1.7.10p7 | 1.9.17p1 |
| BIND | 9.12 | 9.18 |
| iptables | 1.4 | 1.8 |
| Web server | Cherokee 1.2.101 | Cherokee 1.2.104 |

I read these from the firmware images themselves (unpacked on a workstation, never on a device) and from a running unit, then checked them against Opengear's release notes where the notes give a version. Where the notes and the image disagree, I've gone with the image.

## Kernel and core components

- **Kernel 3.10 to 5.17.** Opengear moved the whole product line from Linux 3.10.0 to 5.17.0 in its 5.0.0 release (November 2023), and lists "patched kernel" again in 5.5.1. Neither is a long-term-support kernel branch: 3.10 left upstream support in 2017 and 5.17 in 2022. Both depend on the vendor backporting fixes. The difference is that one vendor is still doing it.
- **OpenSSL 1.0.1 to 3.1.** OpenSSL 1.0.1 stopped getting upstream fixes at the end of 2016. The move to 3.x is what brings TLS 1.3 to the web UI, OpenVPN and other TLS services. OpenSSL 3.1 has itself left upstream support since, so here too the vendor's own patching is what keeps it current.
- **Openswan to strongSwan.** Openswan is no longer developed. strongSwan brings IKEv2, route-based (VTI) tunnels and SHA-256/512 proposals.
- **uClibc to musl, and BusyBox 1.10 to 1.36.** These sit under every shell command and script on the box, including the ones the web UI runs as root.
- **The web server didn't change.** Both use Cherokee, which is unmaintained upstream, so Opengear patches it itself. That's the component behind the newest advisory below.

## Security fixes since the Tripp Lite branch

These are CVEs that Opengear's release notes list as fixed **after** its 4.10.0 release, so they're the gap between the Tripp Lite branch and current Opengear firmware. I've only included IDs the release notes name. Opengear also lists unnamed fixes ("Fixed CVEs", "patched OpenSSL", "patched BusyBox") and now tracks CVE status in its customer portal, so the real list is longer.

| Opengear release | CVE | Component | CVSS |
| --- | --- | --- | --- |
| 4.11.0 (May 2021) | [CVE-2019-20799](https://nvd.nist.gov/vuln/detail/CVE-2019-20799) | Cherokee web server | 7.5 High |
| 4.11.0 | [CVE-2020-12845](https://nvd.nist.gov/vuln/detail/CVE-2020-12845) | Cherokee web server | 7.5 High |
| 4.11.0 | [CVE-2020-1971](https://nvd.nist.gov/vuln/detail/CVE-2020-1971) | OpenSSL (NULL pointer dereference) | 5.9 Medium |
| 4.12.0 (Oct 2021) | [CVE-2016-2183](https://nvd.nist.gov/vuln/detail/CVE-2016-2183) | OpenVPN 64-bit block cipher defaults (Sweet32) | 7.5 High |
| 4.12.0 | [CVE-2016-6329](https://nvd.nist.gov/vuln/detail/CVE-2016-6329) | OpenVPN 64-bit block cipher defaults (Sweet32) | 5.9 Medium ¹ |
| 5.0.1 (Feb 2024) | [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795) | OpenSSH (Terrapin) | 5.9 Medium |
| 5.0.1 | [CVE-2023-5363](https://nvd.nist.gov/vuln/detail/CVE-2023-5363) | OpenSSL | 7.5 High |
| 5.0.1 | [CVE-2023-41913](https://nvd.nist.gov/vuln/detail/CVE-2023-41913) | strongSwan | 9.8 Critical |
| 5.0.1 | [CVE-2023-46849](https://nvd.nist.gov/vuln/detail/CVE-2023-46849) | OpenVPN | 7.5 High |
| 5.0.1 | [CVE-2023-46850](https://nvd.nist.gov/vuln/detail/CVE-2023-46850) | OpenVPN | 9.8 Critical |
| 5.0.1 | [CVE-2023-42465](https://nvd.nist.gov/vuln/detail/CVE-2023-42465) | sudo | 7.0 High |
| 5.0.1 | [CVE-2016-20014](https://nvd.nist.gov/vuln/detail/CVE-2016-20014) | PAM TACACS+ module | 9.8 Critical |
| 5.0.1 | [CVE-2020-13881](https://nvd.nist.gov/vuln/detail/CVE-2020-13881) | PAM TACACS+ module | 7.5 High |
| 5.0.1 | [CVE-2020-27743](https://nvd.nist.gov/vuln/detail/CVE-2020-27743) | PAM TACACS+ module | 9.8 Critical |
| 5.0.1 | [CVE-2020-10595](https://nvd.nist.gov/vuln/detail/CVE-2020-10595) | PAM Kerberos module | 9.8 Critical |
| 5.0.1 | [CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586) | PCRE2 | 9.1 Critical |
| 5.0.1 | [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587) | PCRE2 | 9.1 Critical |
| 5.0.1 | [CVE-2022-41409](https://nvd.nist.gov/vuln/detail/CVE-2022-41409) | PCRE2 | 7.5 High |
| 5.0.1 | [CVE-2008-5730](https://nvd.nist.gov/vuln/detail/CVE-2008-5730) | Netcat | 7.5 High ² |
| 5.2.2 (May 2025) | [CVE-2024-3596](https://nvd.nist.gov/vuln/detail/CVE-2024-3596) | RADIUS client (BlastRADIUS), mitigated with "Require Message-Authenticator" | 9.0 Critical |

Scores are NVD's CVSS 3.1 base scores, except: ¹ CVSS 3.0; ² CVSS 2.0, the only score NVD has for it. A base score rates the flaw in general, not how exposed a particular console server is: whether the affected service is enabled and reachable matters as much. The TACACS+ and Kerberos scores, for example, only apply if you log in with those methods.

**The newest one matters most.** [CVE-2026-102212](https://nvd.nist.gov/vuln/detail/CVE-2026-102212), published 31 October 2026, is a heap buffer overflow in the web UI's `index.cgi`. It's reachable over the network **without logging in** (CVSS 4.0 base score 8.4, High, as published with the CVE; NVD hasn't scored it yet). It covers ACM7000, CM7100 and IM7200 firmware **4.8.0 through 5.5.2**. Public write-ups describe a crash of the web UI process, while Opengear's advisory title says buffer overflow to remote code execution. It's fixed in 5.5.3, whose release notes list "Fixed a potential heap overflow in a multipart web request". Tripp Lite's builds aren't named in the advisory, but they share the same web UI code and their version falls inside the affected range, so I'd treat them as affected. There is no Tripp Lite update for it.

Whatever firmware a console server runs, its management interfaces shouldn't be reachable from untrusted networks. That's the layer that protects you while a patch is pending.

## Features gained

The two firmwares share more than you'd expect. Both have Lighthouse call-home, zero-touch provisioning and a REST backend, and the Tripp Lite build keeps its USB and SNMP UPS support (NUT drivers) after a cross-flash. Neither has WireGuard, containers, Python or nginx. What Opengear adds:

- **TLS 1.3** across the web UI and OpenVPN, from the OpenSSL 3 move.
- **IKEv2 and route-based IPsec** (VTI interfaces), SHA-256/512 proposals, and per-tunnel MTU.
- **OpenVPN 2.6**, with LZO compression off by default and a server-verification option.
- **NAT64**, plus more IPv6 support (DHCPv6 server, IPv6 cellular keepalive).
- **A newer REST API**, including cellular modem firmware updates, Lighthouse failover reporting and a password-complexity policy.
- **Hardening options**: RADIUS Message-Authenticator (BlastRADIUS), kernel SYN cookies, a FIPS mode, encrypted configuration backups, and blocking the literal password `default`.
- **Monitoring**: 58 bundled Nagios checks instead of 17, and more kernel modules and GPIO tools.

Opengear also removed a few things along the way, including SDT Connector, Wi-Fi on the models that had it, and some older host-logging and "permitted services" options. Check the release notes for anything you rely on.

## What you give up, and the trade-offs

| Consideration | What it means |
| --- | --- |
| Vendor support | Neither Tripp Lite nor Opengear supports Opengear firmware on Tripp Lite-branded hardware. You are your own support. |
| Licensing and access | Opengear's firmware images are only downloadable from its customer portal, under Opengear's software user agreement. Read it and make sure you're entitled to use the firmware before you deploy it. |
| Recovery risk | The B093's bootloader has no A/B fallback. A failed write needs someone with a serial cable at the box, so rehearse on a unit you can reach. |
| Going back | Reverting to Tripp Lite firmware is possible, but keeping an Opengear config across the revert locked my lab unit out until a config reset. |
| Model differences | I've only tested a B093. Treat the B097 and B098 as different hardware until proven otherwise. |

If you need a vendor-supported console server, the clean answer is current, in-support hardware on current firmware. If you have B093s in service and want them patched, Opengear's firmware is the maintained branch of the same code, and the rest of this series is about getting there safely.

## References

### Vendor release notes and advisories

- [Opengear release notes, ACM7000 current release](https://ftp.opengear.com/download/opengear_appliances/ACM/current/release-notes.pdf): the 5.x changelog, including package versions and fixed CVEs
- [Opengear release notes, 5.0.5 and earlier](https://ftp.opengear.com/download/opengear_appliances/end_of_sale_products/prev/5.0.5/release-notes.pdf): the 4.x history back past 4.10.0, and the 5.0.0 kernel and OpenSSL move
- [Opengear firmware archive](https://ftp.opengear.com/download/opengear_appliances/ACM/archive/): every published ACM release
- [Opengear Customer Portal](https://portal.opengear.com/): firmware images, SHA-384 checksum files and advisories (login required)
- [CVE-2026-102212 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-102212)

### Hardware

- [Eaton B093-004-2E4U product page](https://www.eaton.com/us/en-us/skuPage.B093-004-2E4U.html)
- [Owner's manual for B093, B097 and B098 series console servers](https://assets.tripplite.com/owners-manual/9338a8_b098_b097_b093_mnl_rev_c.pdf)
- [Tripp Lite B093 firmware files](https://assets.tripplite.com/firmware/b093_firmware_files.zip) (zip, includes 4.10.0)

### Upstream lifecycles

- [Linux kernel releases and long-term support branches](https://www.kernel.org/category/releases.html)
- [OpenSSL release strategy and end-of-life dates](https://openssl-library.org/policies/releasestrat/index.html)

---

Next in the series: [Part 2: Why netflash looked like it bricked my Tripp Lite B093: the -C flag only compares](https://bytesizedtechsolutions.com/articles/tripp-lite-b093-netflash-compare-only/)