Image: Cisco // Composition: ZDNet
Networking equipment vendor Cisco said yesterday it was not going to release firmware updates to fix 74 vulnerabilities that had been reported in its line of RV routers, which had reached end-of-life (EOL).
Affected devices include Cisco Small Business RV110W, RV130, RV130W, and RV215W systems, which can be used as both routers, firewalls, and VPNs.
All four reached EOL in 2017 and 2018 and have also recently exited their last maintenance window as part of paid support contracts on December 1, 2020.
In three security advisories posted yesterday [1, 2, 3], Cisco said that since December, it received bug reports for vulnerabilities ranging from simple denial of service issues that crashed devices to security flaws that could to used to gain access to root accounts and hijack routers.
In total, the device maker said it received 74 bug reports but that it wouldn’t be releasing any software patches, mitigations, or workarounds as the devices had long reached EOL years before.
Instead, the company advised that customers move operations to newer devices, such as the RV132W, RV160, or RV160W models, which provide the same features and which are still being actively supported.
Some of the company’s customers might not like the company’s decision, but the good news is that none of the bugs disclosed today can be exploited easily.
Cisco said that all the vulnerabilities require that an attacker have credentials for the device, which reduces the risk of having a network attacked in the coming weeks or months, giving administrators a chance to plan and prepare a migration plan to newer gear, or at least deploy their own countermeasures, otherwise.
The CVE identifiers of the bugs Cisco declined to patch in its EOL routers are listed below:
- CVE-2021-1146
- CVE-2021-1147
- CVE-2021-1148
- CVE-2021-1149
- CVE-2021-1150
- CVE-2021-1151
- CVE-2021-1152
- CVE-2021-1153
- CVE-2021-1154
- CVE-2021-1155
- CVE-2021-1156
- CVE-2021-1157
- CVE-2021-1158
- CVE-2021-1159
- CVE-2021-1160
- CVE-2021-1161
- CVE-2021-1162
- CVE-2021-1163
- CVE-2021-1164
- CVE-2021-1165
- CVE-2021-1166
- CVE-2021-1167
- CVE-2021-1168
- CVE-2021-1169
- CVE-2021-1170
- CVE-2021-1171
- CVE-2021-1172
- CVE-2021-1173
- CVE-2021-1174
- CVE-2021-1175
- CVE-2021-1176
- CVE-2021-1177
- CVE-2021-1178
- CVE-2021-1179
- CVE-2021-1180
- CVE-2021-1181
- CVE-2021-1182
- CVE-2021-1183
- CVE-2021-1184
- CVE-2021-1185
- CVE-2021-1186
- CVE-2021-1187
- CVE-2021-1188
- CVE-2021-1189
- CVE-2021-1190
- CVE-2021-1191
- CVE-2021-1192
- CVE-2021-1193
- CVE-2021-1194
- CVE-2021-1195
- CVE-2021-1196
- CVE-2021-1197
- CVE-2021-1198
- CVE-2021-1199
- CVE-2021-1200
- CVE-2021-1201
- CVE-2021-1202
- CVE-2021-1203
- CVE-2021-1204
- CVE-2021-1205
- CVE-2021-1206
- CVE-2021-1207
- CVE-2021-1208
- CVE-2021-1209
- CVE-2021-1210
- CVE-2021-1211
- CVE-2021-1212
- CVE-2021-1213
- CVE-2021-1214
- CVE-2021-1215
- CVE-2021-1216
- CVE-2021-1217
- CVE-2021-1307
- CVE-2021-1360
