Cisco has published an advisory alerting users to vulnerabilities in some of its small business routers. The flaws, an authentication bypass vulnerability and a remote commend execution vulnerability, affect Cisco Small Business RV016, RV042, RV042G, and RV082 routers. Cisco will not release updates to address the flaws.
Note
- Cisco last sold these devices in 2016. Maybe they built them too well given how many of them still appear to be in use. Every device you buy comes with an expiration date and you need to plan and budget for timely replacements. I just wish the expiration date would be clearly visible on the device.
- These are end-of-life products. Disablement of remote management and blocking access to ports 443 and 60443 are the only partial workarounds, the real fix is to replace these. With a CVSS score of 9.0, maybe do it quickly? I know, they are on your list, and you bought replacements which arrived, excellent! Deploy them, in the off chance you missed lining up replacements, leverage this information to justify rapid action.
- These devices should be called “Cisco in name only.” The Small Business routers that are the constant front-page news here are part of the Small Business Unit for Cisco. Cisco IOS is not running on any of these units, and these units probably keep their internal Product Security Team (PSIRT) busy. The problem I see is that they carry the Cisco brand but have obvious security issues. Why we keep seeing C Memory Corruption bugs on web Interfaces is beyond me. As these units are sold to small companies, the worst part is that they will probably not be patched. Whenever I talk to a small business owner, I urge them into a cloud-managed system that auto updates. Pick one in that Prosumer / Small business space and have the manufacturer keep it up to date with a cloud-controlled system. It’s not the most ideal, but in the long run probably cheaper than paying for ransomware.
Read more in
