4 ms·
> It should go without saying, but the HTTP and HTTPS server feature should never be enabled on Internet-facing systems as is consistent with long-established b
by jpc0 3y ago
> It should go without saying, but the HTTP and HTTPS server feature should never be enabled on Internet-facing systems as is consistent with long-established best practices. Cisco reiterated the guidance in Monday’s advisory.
I mean a 0day is always bad, specially a high severity one but this was the first thing I though, why was it accessable from the public internet.
All critical hardware's management plane should only be accessible from a hardened jump box.
- acdha 3y agoYeah, I would like Cisco not to ship software this easily compromised but in this case I don’t think it’d be unwarranted to contact the victims’ CEOs and say their network team is incompetent. Not leaving this stuff exposed to the internet is an entry-level skill.
- kjs3 3y agoI don't think I've ever met a Cisco IOS admin who configured via the web interface that I would allow to touch production networks, and certainly not anything internet facing.