News RV340/345 Security Vulnerability

[jasonreg]

Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability

I am having a bit of difficulty in deciding how worried I should be, but I am concerned with the "there are no work-arounds" and "we are not going to fix it statements".

One question I have for the group is what (if any?) impact would I see by disabling the RESTCONF option as described in the article?

(thx to GKToronto for posting this on the Cisco SB Forum)

 

[Tech9]

If you don't want to disturb your working setup and have security concerns - place another firewall in front of your RV34x router.

 

[Miner]

That RESTCONF setting has a checkbox for LAN and WAN. Surprisingly the Cisco advisory does not even mention this.

That being so, I'm going to proceed with 'keeping the WAN checkmark set to off' is good enough.

The Cisco Admin Guide for RESTCONF says nothing useful, e.g., "By default, it is enabled on LAN interface. It can also be enabled on both LAN and WAN interfaces."

 

[jasonreg]

This is how (RESTCONF unchecked) I have been running since this advisory came out. I have not seen any issues whatsoever. That said, I will be replacing the router shortly I think.