CVE-2023-35803 mitigation ?

[fran1942]

Hello, until we get the firmware upgraded, what sort of AP firewall policy is required to mitigate this vulnerability ? i.e inbound/outbound ? blocking port 5916 ?

CVE-2023-35803

Thank you kindly

[LaurentA · Accepted solution]

Hi,

According to the researcher Blog and Exploit code, the attacker needs to connect to the AP over the port TCP/5916.
A quick workaround should be to block this port to anyone (using Firewall in User-Profiles for Wi-Fi users, and using classic LAN segmentation for the wired users).
Regards,

[fran1942]

thank you. Would that be an inbound or outbound policy to block TCP 5916 ?

[LaurentA]

Hi,
In all your Wireless User-Profiles  in Firewall "Outbound Policy" you should block connection to TCP/5916 port by creating a "Deny" rule on top.
This will prevent attack from Wireless Users (for the Wired one, rely on your corporate firewall, as long as the AP are in an isolated network).
To ensure the port is not reachable anymore, you can use Microsoft Powershell "Test-NetConnection" commandlet.
Example, if your Access Point IP address is 10.0.0.10, you can use the following powershell command :
tnc 10.0.0.10 -port 5916
The "TcpTestSucceeded" result should be "false".

Regards,

[fran1942]

thank you. So an 'outbound' policy controls traffic coming into the AP from wireless users ?