> Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? IOS routers and ASA firewalls are on the "not affected"

> Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? IOS routers and ASA firewalls are on the "not affected" list. Those are what you'd find in most SMBs. IOS-XR and NX-OS are affected, however. This software runs on the BFRs like you'd see in major ISPs and large networks. > Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable? I'm speculating but based on what I know about Cisco gear, I'm gonna have to say no. At most, you'd get the same stuff you'd get from a server: the private keys, login credentials, copies of the configuration, etc. -- anything that's handled by the control plane of the routers, basically. The frames/packets passing through them are handled by ASICs and are never copied to the memory used by the CPU, AIUI. Assuming best practices are followed, a random attacker would never be able to establish a connection (e.g. to 443/TCP) anyways, which would mitigate the risk. In a properly managed network, access to the router itself is highly restricted by ACLs and such.