craig.miller

← All articles

Tripp Lite B093 vs Opengear firmware: kernel, CVEs and features

Why you'd move a Tripp Lite B093 console server to Opengear ACM700x firmware at all, and what you'd gain and give up - kernel, crypto libraries, CVEs fixed since Tripp Lite's last release, and features.

by Markdown
  • console servers
  • firmware
  • security
  • embedded linux
  • opengear
  • tripp lite

What the B093 is, and why its firmware matters

The Tripp Lite (now Eaton) B093 is a small serial console server: a few RJ45 serial ports, dual gigabit Ethernet, USB, and on some models a 4G LTE modem for out-of-band access. You rack one so that when a firewall, switch or router is broken, you can still reach its console.

Under the badge it’s Opengear ACM7000-family hardware running a rebranded build of Opengear’s firmware. That shared lineage is what makes a cross-flash possible. It’s also why the firmware gap matters. A console server is the device you reach when everything else is down, often over a cellular link, and it holds the keys to every console it’s cabled to. It should be running a current, patched operating system.

The short answer

The newest B093 firmware I could find publicly is Tripp Lite 4.10.0, built in December 2020. It lines up with Opengear’s own 4.10.0 release from the same month. Opengear has kept releasing for the same hardware since then, through 5.5.3 in October 2026.

The case for moving is mostly security, not features. The Tripp Lite build’s crypto and remote-access stack is 8 to 18 years old, and several of its components are end-of-life upstream.

Component Tripp Lite 4.10.0 Opengear 5.5.x
Linux kernel 3.10.0 (gcc 4.8.1) 5.17.0 (gcc 11.2)
C library uClibc 0.9.33 musl 1.2.2
OpenSSL 1.0.1u (2016, end-of-life) 3.1.8, with TLS 1.3
OpenSSH 7.7p1 10.4p1 to 10.6p1
IPsec Openswan 2.6.37 (project discontinued) strongSwan 5.9.12 to 6.1.0, with IKEv2
OpenVPN 2.4.6 2.6.21
libcurl 7.19.0 (2008) 8.4.0
BusyBox 1.10.2 (2008) 1.36.1
sudo 1.7.10p7 1.9.17p1
BIND 9.12 9.18
iptables 1.4 1.8
Web server Cherokee 1.2.101 Cherokee 1.2.104

I read these from the firmware images themselves (unpacked on a workstation, never on a device) and from a running unit, then checked them against Opengear’s release notes where the notes give a version. Where the notes and the image disagree, I’ve gone with the image.

Kernel and core components

  • Kernel 3.10 to 5.17. Opengear moved the whole product line from Linux 3.10.0 to 5.17.0 in its 5.0.0 release (November 2023), and lists “patched kernel” again in 5.5.1. Neither is a long-term-support kernel branch: 3.10 left upstream support in 2017 and 5.17 in 2022. Both depend on the vendor backporting fixes. The difference is that one vendor is still doing it.
  • OpenSSL 1.0.1 to 3.1. OpenSSL 1.0.1 stopped getting upstream fixes at the end of 2016. The move to 3.x is what brings TLS 1.3 to the web UI, OpenVPN and other TLS services. OpenSSL 3.1 has itself left upstream support since, so here too the vendor’s own patching is what keeps it current.
  • Openswan to strongSwan. Openswan is no longer developed. strongSwan brings IKEv2, route-based (VTI) tunnels and SHA-256/512 proposals.
  • uClibc to musl, and BusyBox 1.10 to 1.36. These sit under every shell command and script on the box, including the ones the web UI runs as root.
  • The web server didn’t change. Both use Cherokee, which is unmaintained upstream, so Opengear patches it itself. That’s the component behind the newest advisory below.

Security fixes since the Tripp Lite branch

These are CVEs that Opengear’s release notes list as fixed after its 4.10.0 release, so they’re the gap between the Tripp Lite branch and current Opengear firmware. I’ve only included IDs the release notes name. Opengear also lists unnamed fixes (“Fixed CVEs”, “patched OpenSSL”, “patched BusyBox”) and now tracks CVE status in its customer portal, so the real list is longer.

Opengear release CVE Component CVSS
4.11.0 (May 2021) CVE-2019-20799 Cherokee web server 7.5 High
4.11.0 CVE-2020-12845 Cherokee web server 7.5 High
4.11.0 CVE-2020-1971 OpenSSL (NULL pointer dereference) 5.9 Medium
4.12.0 (Oct 2021) CVE-2016-2183 OpenVPN 64-bit block cipher defaults (Sweet32) 7.5 High
4.12.0 CVE-2016-6329 OpenVPN 64-bit block cipher defaults (Sweet32) 5.9 Medium ¹
5.0.1 (Feb 2024) CVE-2023-48795 OpenSSH (Terrapin) 5.9 Medium
5.0.1 CVE-2023-5363 OpenSSL 7.5 High
5.0.1 CVE-2023-41913 strongSwan 9.8 Critical
5.0.1 CVE-2023-46849 OpenVPN 7.5 High
5.0.1 CVE-2023-46850 OpenVPN 9.8 Critical
5.0.1 CVE-2023-42465 sudo 7.0 High
5.0.1 CVE-2016-20014 PAM TACACS+ module 9.8 Critical
5.0.1 CVE-2020-13881 PAM TACACS+ module 7.5 High
5.0.1 CVE-2020-27743 PAM TACACS+ module 9.8 Critical
5.0.1 CVE-2020-10595 PAM Kerberos module 9.8 Critical
5.0.1 CVE-2022-1586 PCRE2 9.1 Critical
5.0.1 CVE-2022-1587 PCRE2 9.1 Critical
5.0.1 CVE-2022-41409 PCRE2 7.5 High
5.0.1 CVE-2008-5730 Netcat 7.5 High ²
5.2.2 (May 2025) CVE-2024-3596 RADIUS client (BlastRADIUS), mitigated with “Require Message-Authenticator” 9.0 Critical

Scores are NVD’s CVSS 3.1 base scores, except: ¹ CVSS 3.0; ² CVSS 2.0, the only score NVD has for it. A base score rates the flaw in general, not how exposed a particular console server is: whether the affected service is enabled and reachable matters as much. The TACACS+ and Kerberos scores, for example, only apply if you log in with those methods.

The newest one matters most. CVE-2026-102212, published 31 October 2026, is a heap buffer overflow in the web UI’s index.cgi. It’s reachable over the network without logging in (CVSS 4.0 base score 8.4, High, as published with the CVE; NVD hasn’t scored it yet). It covers ACM7000, CM7100 and IM7200 firmware 4.8.0 through 5.5.2. Public write-ups describe a crash of the web UI process, while Opengear’s advisory title says buffer overflow to remote code execution. It’s fixed in 5.5.3, whose release notes list “Fixed a potential heap overflow in a multipart web request”. Tripp Lite’s builds aren’t named in the advisory, but they share the same web UI code and their version falls inside the affected range, so I’d treat them as affected. There is no Tripp Lite update for it.

Whatever firmware a console server runs, its management interfaces shouldn’t be reachable from untrusted networks. That’s the layer that protects you while a patch is pending.

Features gained

The two firmwares share more than you’d expect. Both have Lighthouse call-home, zero-touch provisioning and a REST backend, and the Tripp Lite build keeps its USB and SNMP UPS support (NUT drivers) after a cross-flash. Neither has WireGuard, containers, Python or nginx. What Opengear adds:

  • TLS 1.3 across the web UI and OpenVPN, from the OpenSSL 3 move.
  • IKEv2 and route-based IPsec (VTI interfaces), SHA-256/512 proposals, and per-tunnel MTU.
  • OpenVPN 2.6, with LZO compression off by default and a server-verification option.
  • NAT64, plus more IPv6 support (DHCPv6 server, IPv6 cellular keepalive).
  • A newer REST API, including cellular modem firmware updates, Lighthouse failover reporting and a password-complexity policy.
  • Hardening options: RADIUS Message-Authenticator (BlastRADIUS), kernel SYN cookies, a FIPS mode, encrypted configuration backups, and blocking the literal password default.
  • Monitoring: 58 bundled Nagios checks instead of 17, and more kernel modules and GPIO tools.

Opengear also removed a few things along the way, including SDT Connector, Wi-Fi on the models that had it, and some older host-logging and “permitted services” options. Check the release notes for anything you rely on.

What you give up, and the trade-offs

Consideration What it means
Vendor support Neither Tripp Lite nor Opengear supports Opengear firmware on Tripp Lite-branded hardware. You are your own support.
Licensing and access Opengear’s firmware images are only downloadable from its customer portal, under Opengear’s software user agreement. Read it and make sure you’re entitled to use the firmware before you deploy it.
Recovery risk The B093’s bootloader has no A/B fallback. A failed write needs someone with a serial cable at the box, so rehearse on a unit you can reach.
Going back Reverting to Tripp Lite firmware is possible, but keeping an Opengear config across the revert locked my lab unit out until a config reset.
Model differences I’ve only tested a B093. Treat the B097 and B098 as different hardware until proven otherwise.

If you need a vendor-supported console server, the clean answer is current, in-support hardware on current firmware. If you have B093s in service and want them patched, Opengear’s firmware is the maintained branch of the same code, and the rest of this series is about getting there safely.

References

Vendor release notes and advisories

Hardware

Upstream lifecycles