Hash: SHA256

             AUSCERT External Security Bulletin Redistribution

    Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Issues
                              7 November 2019


        AusCERT Security Bulletin Summary

Product:           Cisco Small Business RV016, RV042, RV042G, and RV082 Routers
Publisher:         Cisco Systems
Operating System:  Network Appliance
Impact/Access:     Root Compromise  -- Existing Account   
                   Reduced Security -- Unknown/Unspecified
Resolution:        Patch/Upgrade

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Issues

Priority:        Informational

Advisory ID:     cisco-sa-20191106-rv0x2

First Published: 2019 November 6 16:00 GMT

Version 1.0:     Final

Workarounds:     No workarounds availableCisco Bug IDs:   CSCvq34370CSCvq34376



  o Cisco firmware for certain Cisco Small Business RV Series Routers is
    affected by the following issues:

       Certificate and key issued to QNO Technology
       Hardcoded password hashes
       Multiple vulnerabilities in third-party software (TPS) components

    Certificate and Key Issued to QNO Technology

    An X.509 certificate with a corresponding public/private key pair was
    initially found in Cisco RV042 Dual WAN VPN Router firmware. This
    certificate is issued to third-party entity QNO Technology.

    The certificate and keys in question are part of the firmware for the
    following Cisco products:

       RV016 Multi-WAN VPN Router
       RV042 Dual WAN VPN Router
       RV042G Dual Gigabit WAN VPN Router
       RV082 Dual WAN VPN Router

    The certificate and keys were used for testing during the development of
    the firmware; they were never used for live functionality in any shipping
    version of the product. All shipping versions of the firmware for the
    affected products use dynamically created certificates instead.

    The inclusion of this certificate and keys in shipping software was an
    oversight by the development team for these routers.

    Cisco bug ID: CSCvq34370

    Hardcoded Password Hashes

    The /etc/shadow file included in Cisco firmware for the following Cisco
    products contains hardcoded password hashes for the users root , cisco ,
    and lldpd .

       RV016 Multi-WAN VPN Router
       RV042 Dual WAN VPN Router
       RV042G Dual Gigabit WAN VPN Router
       RV082 Dual WAN VPN Router

    The /etc/shadow file is not consulted during user authentication by the
    firmware. Instead, a dedicated alternate user database is used to
    authenticate users who log in to the web-based management interface of the
    affected routers.

    An attacker with access to the base operating system on an affected device
    could exploit this issue to obtain elevated privileges at the level of the
    root , cisco , or lldpd user. However, Cisco is not currently aware of a
    way to access the base operating system on these routers.

    Cisco bug ID: CSCvq34376

    Multiple Vulnerabilities in Third-Party Software Components

    Third-party software (TPS) components in the firmware for the following
    products contain vulnerabilities:

       RV016 Multi-WAN VPN Router
       RV042 Dual WAN VPN Router
       RV042G Dual Gigabit WAN VPN Router
       RV082 Dual WAN VPN Router

    Cisco will handle these vulnerabilities by using the regular Cisco process
    for TPS vulnerabilities in accordance with the Cisco Security Vulnerability
    Policy . For information about known TPS vulnerabilities that affect the
    firmware for these routers, consult the Cisco Bug Search Tool .

Affected Products

  o These issues affect the following Cisco Small Business RV Series Routers
    when they are running a firmware release earlier than

       RV016 Multi-WAN VPN Router ^ 1
       RV042 Dual WAN VPN Router
       RV042G Dual Gigabit WAN VPN Router
       RV082 Dual WAN VPN Router ^ 1

    1. The Cisco RV016 Multi-WAN VPN Router and RV082 Dual WAN VPN Router have
    reached the end of software maintenance.

    Products Confirmed Not Affected

    Only products listed in the Affected Products section of this advisory are
    known to be affected by these issues.

    Updated Firmware

    Cisco removed the static certificates and keys as well as the hardcoded
    password hashes in firmware releases and later for the Cisco RV042
    Dual WAN VPN Router and RV042G Dual Gigabit WAN VPN Router.

    Customers can download the firmware from the Software Center on Cisco.com
    by doing the following:

       Click Browse all.
       Choose Routers > Small Business Routers > Small Business RV Series
       Choose a specific product from the right pane of the product selector.
       Click Small Business Router Firmware.


  o Cisco would like to thank security researchers Stefan Viehbock and Thomas
    Weber of SEC Consult/IoT Inspector for reporting these issues.

Cisco Security Vulnerability Policy

  o To learn about Cisco security vulnerability disclosure policies and
    publications, see the Security Vulnerability Policy . This document also
    contains instructions for obtaining fixed software and receiving security
    vulnerability information from Cisco.


  o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/

Revision History

  o +---------+-------------------------+---------+--------+------------------+
    | Version |       Description       | Section | Status |       Date       |
    | 1.0     | Initial public release. | -       | Final  | 2019-November-06 |

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967