- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎07-19-2023 12:43 AM
Hello, until we get the firmware upgraded, what sort of AP firewall policy is required to mitigate this vulnerability ? i.e inbound/outbound ? blocking port 5916 ?
CVE-2023-35803
Thank you kindly
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎07-20-2023 05:08 AM
Hi,
According to the researcher Blog and Exploit code, the attacker needs to connect to the AP over the port TCP/5916.
A quick workaround should be to block this port to anyone (using Firewall in User-Profiles for Wi-Fi users, and using classic LAN segmentation for the wired users).
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎07-25-2023 06:50 AM
Hi, "Outbound" policy controls traffic sent by the Wireless Users (whatever is the destination).
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎07-19-2023 06:01 AM
For anyone who missed it here is the CVE announcement - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2023-067-iq-engine-acsd-ser...
I too would like to know a few more details about this CVE.
The other CVE posted Monday specifies what access is needed to conduct the exploit. I'm not seeing that information for this one which seems like very relevant information given that there are so many AP models that won't be seeing a patch for this for at least 3 months or more!
