Vendor affected: TP-Link (http://tp-link.com)
Products affected:
* All TP-Link VxWorks-based devices (confirmed by vendor)
* All "2-series" switches (confirmed by vendor)
* TL-SG2008 semi-managed switch (confirmed by vendor)
* TL-SG2216 semi-managed switch (confirmed by vendor)
* TL-SG2424 semi-managed switch (confirmed by vendor)
* TL-SG2424P semi-managed switch (confirmed by vendor)
* TL-SG2452 semi-managed switch (confirmed by vendor)
Vulnerabilities:
* All previously-reported VxWorks vulnerabilities from 6.6.0 on;
at the very least:
* CVE-2013-0716 (confirmed by vendor)
* CVE-2013-0715 (confirmed by vendor)
* CVE-2013-0714 (confirmed by vendor)
* CVE-2013-0713 (confirmed by vendor)
* CVE-2013-0712 (confirmed by vendor)
* CVE-2013-0711 (confirmed by vendor)
* CVE-2010-2967 (confirmed by vendor)
* CVE-2010-2966 (confirmed by vendor)
* CVE-2008-2476 (confirmed by vendor)
* SSLv2 is available and cannot be disabled unless HTTPS is
completely disabled (allows downgrade attacks)
(confirmed by vendor)
* SSL (v2, v3) offers insecure cipher suites and HMACs which cannot
be disabled (allows downgrade attacks)
(confirmed by vendor)
Design flaws:
* Telnet is available and cannot be disabled (confirmed by vendor)
* SSHv1 enabled by default if SSH is enabled (confirmed by vendor)
Vendor response:
TP-Link are not convinced that these flaws should be repaired.
TP-Link's Internet presence -- or at least DNS -- is available only
intermittently. Most emails bounced. Lost contact with vendor, but
did confirm that development lead is now on holiday and will not
return for at least a week.
Initial vendor reaction was to recommend purchase of "3-series"
switches. Vendor did not offer reasons why "3-series" switches would
be more secure, apart from lack of telnet service. Vendor confirmed
that no development time can be allocated to securing "2-series"
product and all focus has shifted to newer products.
(TL-SG2008 first product availability July 2014...)
Vendor deeply confused about security of DES/3DES, MD5, claimed that
all security is relative. ("...[E]ven SHA-1 can be cracked, they just
have different security level.")
Fix availability:
None.
Work-arounds advised:
None possible. Remove products from network.
