3

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability.

We have the latest firmware (Apr 2014) installed, but can't wait around forever for Cisco to fix. So I have a few questions:

1) There is an option to disable SSL on the router. Does anyone know what the effects of this are? Does this only impact the web admin, or would VPN also be impacted?

2) Cisco seems to have fallen over a cliff on support of their products. What alternatives have you had success with that provide regular firmware updates (especially for PCI/Security related issues) and good support for their products?

14
  • 1
    It's still "currently under investigation"?! That is slow. Commented Oct 20, 2014 at 15:02
  • Also... exactly what on the router was flagged? Commented Oct 20, 2014 at 15:11
  • "The version of OpenSSL running on this host is vulnerable to a man in the middle attack due to the improper handling of ChangeCipherSpec messages. This vulnerability can allow remote attackers the ability to read and inject messages within client connections." They go on to mention remediation: "This issue was fixed in OpenSSL versions 0.9.8za, 1.0.0m, and 1.0.1h. It is strongly recommended to install the newest, stable version of OpenSSL." Unfortunately, Cisco has been slow to patch the new version of OpenSSL into their firmware.
    – Sam
    Commented Oct 20, 2014 at 15:19
  • Exactly what was flagged: tcp/443, tcp/60443
    – Sam
    Commented Oct 20, 2014 at 15:21
  • You need to turn off remote administration of the router as a stop-gap measure, to take care of port 443. I dunno what's on port 60443. Commented Oct 20, 2014 at 15:21

1 Answer 1

3

I propose for now that you:

  1. Ensure that remote administration of the RV-042 is actually disabled.
  2. Dispute the finding with Trustwave and cite that you have a compensating control, namely, that all connections to those ports are immediately dropped.

In the long term you should probably find another router, the software for which is better supported by its manufacturer. (I'm not going to make any recommendations, though.)

1
  • So, last night after hours I disabled HTTPS on the router. I was a little hesitant to do it because I couldn't find any documentation on what issues it might cause (e.g. - breaking VPN, messing up HTTPS for web clients, etc). VPN still works and nothing seems to be broken, so it appears that it was only there for the Remote Administration. I re-ran the Trustwave scan and it came back clean.
    – Sam
    Commented Oct 21, 2014 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .