topic Re: Weak SSL/TLS Key Exchange in Network Security

Weak SSL/TLS Key Exchange

mohammedalrawiib — Thu, 18 Apr 2024 09:15:07 GMT

I hope your doing well

in our network infrastructure where we have Qualys to scan for vulnerabilities i can't find a solution for this certain vulnerability here are the details :

Weak SSL/TLS Key Exchange

impact an attacker with access to sufficient computational power might be able to recover the session key and decrypt session content

i have tried the suggested solution from both community cisco but when we i scan again the vulnerability remains the same , the solution that i have tried is to disable SSL/TLS on the switches after scanning it still shows the same vulnerability ,also i have tried to configure the cipher suite with AES 256 the vulnerability remains the same .

the switch we have is cisco 9200 version 17.6

best regards

Re: Weak SSL/TLS Key Exchange

Rob Ingram — Thu, 18 Apr 2024 09:27:13 GMT

@mohammedalrawiib what commands did you configure? Provide the configuration.

Did you use the command - no ip http secure-server to disable https server?

You could also apply an ACL to restrict traffic to trusted sources, that would help mitigate the issue.

Re: Weak SSL/TLS Key Exchange

mohammedalrawiib — Thu, 18 Apr 2024 09:29:34 GMT

Yes i tried to use the command no ip http secure-server but the vulnerability remains in the scan report

Re: Weak SSL/TLS Key Exchange

Rob Ingram — Thu, 18 Apr 2024 09:36:56 GMT

@mohammedalrawiib with that command, https on the switch is disabled and should not respond.

Are you sure a new scan was run after that command was configured?

Provide your configuration

Re: Weak SSL/TLS Key Exchange

mohammedalrawiib — Thu, 18 Apr 2024 12:38:23 GMT

tried to scan 2 times and the vulnerability still remains is there anything i can try ?

can't provide configuration right now, will provide on Sunday

regards

Re: Weak SSL/TLS Key Exchange

mohammedalrawiib — Tue, 28 May 2024 12:53:11 GMT

Dears

after a while we changed the ssh port number (default is 22) to another port also we blocked 22 port then the vulnerability was removed this is the solution that we found if you have any other solution please let us know

best regards