4 ms·

See CVE: https://www.cvedetails.com/vulnerability-list.php?vendor_id=16&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=

See CVE: https://www.cvedetails.com/vulnerability-list.php?vendor_id=16&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=4362&sha=b6b9f0966b7dbca88b729e5b85a1f8fffc37d986 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... At some point you have to think these are deliberate.

TedDoesntTalk 4y ago
Like the deliberate ones from TP-Link?
2OEH8eoCRo0 4y ago
Extraordinary claims require extraordinary evidence. All I see are a lot of CVEs.
- fbdab103 4y ago
  If not intentional, it at least points to a culture that cannot be trusted with producing secure devices.
  - freshpots 4y ago
    Does it though? Are you a SWE?
    - fbdab103 4y ago
      Given the number of times that a hard-coded password has been distributed on Cisco gear, yeah, I think it points to a cultural failure.
      - Spooky23 4y ago
        That happened 15 years ago dude, on Linksys gear. The first CVE on that list is probably older than a few of the commenters on this thread.
        fbdab103 4y ago
        A cursory internet search reveals several that popped up within the past decade on Cisco's gear. Hard-coded passwords are table stakes, if that slips through, what else is lurking beneath the surface? Network hardware is to operate in the adversarial landscape which is the open internet. It requires an extreme, exhaustive workflow to ensure bugs do not slip through. That we repeatedly see these failures does not raise confidence. - 2016-01 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air https://tools.cisco.com/security/center/content/CiscoSecurit... - 2018-03 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180307-cpcp.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2018-10 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20181003-cpcp-password.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2019-07 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred https://tools.cisco.com/security/center/content/CiscoSecurit... Edit: formatting

TedDoesntTalk 4y ago

Like the deliberate ones from TP-Link?

2OEH8eoCRo0 4y ago

Extraordinary claims require extraordinary evidence. All I see are a lot of CVEs.

fbdab103 4y ago
If not intentional, it at least points to a culture that cannot be trusted with producing secure devices.
- freshpots 4y ago
  Does it though? Are you a SWE?
  - fbdab103 4y ago
    Given the number of times that a hard-coded password has been distributed on Cisco gear, yeah, I think it points to a cultural failure.
    - Spooky23 4y ago
      That happened 15 years ago dude, on Linksys gear. The first CVE on that list is probably older than a few of the commenters on this thread.
      - fbdab103 4y ago
        A cursory internet search reveals several that popped up within the past decade on Cisco's gear. Hard-coded passwords are table stakes, if that slips through, what else is lurking beneath the surface? Network hardware is to operate in the adversarial landscape which is the open internet. It requires an extreme, exhaustive workflow to ensure bugs do not slip through. That we repeatedly see these failures does not raise confidence. - 2016-01 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air https://tools.cisco.com/security/center/content/CiscoSecurit... - 2018-03 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180307-cpcp.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2018-10 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20181003-cpcp-password.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2019-07 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred https://tools.cisco.com/security/center/content/CiscoSecurit... Edit: formatting