Cisco has published an advisory alerting users to vulnerabilities in some of its small business routers. The flaws, an authentication bypass vulnerability and a remote commend execution vulnerability, affect Cisco Small Business RV016, RV042, RV042G, and RV082 routers. Cisco will not release updates to address the flaws.
Note
- Cisco last sold these devices in 2016. Maybe they built them too well given how many of them still appear to be in use. Every device you buy comes with an expiration date and you need to plan and budget for timely replacements. I just wish the expiration date would be clearly visible on the device.
- These are end-of-life products. Disablement of remote management and blocking access to ports 443 and 60443 are the only partial workarounds, the real fix is to replace these. With a CVSS score of 9.0, maybe do it quickly? I know, they are on your list, and you bought replacements which arrived, excellent! Deploy them, in the off chance you missed lining up replacements, leverage this information to justify rapid action.
- These devices should be called “Cisco in name only.” The Small Business routers that are the constant front-page news here are part of the Small Business Unit for Cisco. Cisco IOS is not running on any of these units, and these units probably keep their internal Product Security Team (PSIRT) busy. The problem I see is that they carry the Cisco brand but have obvious security issues. Why we keep seeing C Memory Corruption bugs on web Interfaces is beyond me. As these units are sold to small companies, the worst part is that they will probably not be patched. Whenever I talk to a small business owner, I urge them into a cloud-managed system that auto updates. Pick one in that Prosumer / Small business space and have the manufacturer keep it up to date with a cloud-controlled system. It’s not the most ideal, but in the long run probably cheaper than paying for ransomware.
Read more in
Alex Lim
Alex Lim is a certified IT Technical Support Architect with over 15 years of experience in designing, implementing, and troubleshooting complex IT systems and networks. He has worked for leading IT companies, such as Microsoft, IBM, and Cisco, providing technical support and solutions to clients across various industries and sectors. Alex has a bachelor’s degree in computer science from the National University of Singapore and a master’s degree in information security from the Massachusetts Institute of Technology. He is also the author of several best-selling books on IT technical support, such as The IT Technical Support Handbook and Troubleshooting IT Systems and Networks. Alex lives in Bandar, Johore, Malaysia with his wife and two chilrdren. You can reach him at [email protected] or follow him on Website | Twitter | Facebook
