bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Cisco warns of security holes it will not patch

Summary

In January 2023 Cisco warned of critical holes in the small business routers RV016, RV042, RV042G and RV082, but announced that it would not deliver any more updates. Manipulated HTTP requests to the web interface could bypass authentication and gain root access (CVE-2023-20025). As the devices had reached end of life, Cisco only pointed to blocking ports 443 and 60443, although proof-of-concept code already existed.

Ideas

  • Devices past end of support remain permanently vulnerable.
  • A second hole (CVE-2023-20026) allowed code execution with admin credentials.
  • Without a reachable management interface, neither hole can be exploited.
  • At Cisco, hardware support and software maintenance end at different times.

Insights

  • A device’s end of support is a security date, not just a contract date.
  • Workarounds do not replace patches when attack code is already circulating.

Facts

  • Support for the RV082 and RV016 ended in 2021.
  • Software maintenance for the RV042 and RV042G ended in 2021; the hardware was supported until 2025.

References

Critique

  • The report does not say how many of these routers were still reachable from the internet.

Recommendations

  • Keep an inventory with end-of-support dates for all network devices.
  • Replace routers before their software maintenance ends, not only after a hole.

Read the original article

Search the Web Archive

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

g · 2018

Lenovo admits security holes in Fingerprint Manager

In January 2018 Lenovo admitted holes in its Fingerprint Manager Pro software, which managed biometric data on computers running Windows 7, 8 and 8.1. The software used a weak encryption algorithm, contained a hard-coded password and was accessible to local users without special rights. Windows 10 was not affected because Windows Hello takes over the function there.

g · 2017

BSI warns of security hole in 60 Netgear models

In January 2017 the BSI warned of a hole in around 60 Netgear router models through which attackers could read out the password of the web interface. It could be exploited if password recovery was disabled and the attacker was on the same network or remote management was active. The BSI rated the risk at level 5 without clearly explaining what that means.