nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes BOFH

Cisco SOHO switches patched for SOHOpeless vuln

Buggy defaults in SNMP

By Richard Chirgwin, 1 Sep 2016

This week's Cisco patch round includes a critical vuln in the kind of product least likely to get patched – a small business Ethernet switch.

The Small Business 220 Series Smart Plus switches ship with a hard-coded SNMP community string, which means if it's visible to the Internet, a remote attacker can access its SNMP objects.

While Cisco rates the vulnerability as critical, it also notes that SNMP is off by default on the devices; it's only if the management protocol is turned on that the devices are vulnerable.

It's present on switches running firmware release 1.0.0.17, 1.0.0.18, and 1.0.0.19; new firmware is available.

The same switches also have issues in their Web interface: a cross-site request forgery bug; a cross-site scripting issue; and a denial-of-service vulnerability.

WebEx Meetings Player can be crashed by a remote attacker – in the author's experience it can be crashed just by trying to join a meeting, but whatever – and a new version is available.

There are also a couple of minor DoS vulnerabilities in Switchzilla's wireless LAN controller software. ®

The Register - Independent news and views for the tech community. Part of Situation Publishing