Executive Summary

This vulnerability is a medium-severity issue in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software. It occurs because the SSH service lacks effective flood protection, allowing an unauthenticated, remote attacker to flood the SSH service and cause a denial of service (DoS). When exploited, the SSH service becomes unresponsive during the attack, although other device operations remain stable. It affects versions 1.1.0 and earlier with SSH enabled by default. [1]

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can cause the SSH service on the affected device to stop responding by flooding it, resulting in a denial of service (DoS). This means you could lose remote SSH access to the device during the attack, potentially disrupting management or automation tasks that rely on SSH. However, other device operations will continue to function normally during the attack. [1]

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or methods provided for this vulnerability. However, monitoring for unusual SSH service unresponsiveness or high SSH port traffic indicative of a flood attack may help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the SSH service if it is not required by using the CLI command `ssh-server disable` or through the web UI by unchecking the SSH option. This mitigation has been tested successfully but may impact network functionality. The recommended full remediation is to upgrade to Cisco IEC6400 Wireless Backhaul Edge Compute Software version 1.2.0, which contains the fix for this vulnerability. [1]

Useful 0 Not Useful 0