Audit scan of phones exposes ssh "open"

[joeharb]

An internal scan of our phones has resulted in a finding that phones reject an ssh connection when the SSH is disabled.  I would expect the phone to not respond to ssh requests if it is disabled as opposed to rejecting the connection on port 22.  Is there any way to enforce the device not to respond to ssh requests instead of rejecting them?

We have tested by enabling the ssh on a phone and we get a prompt for creds, when disabled we get a connection refused.

Thanks,

Joe

[Mohammed al Baqari]

Short answer is no. Use an ACL on phone ports to deny ssh ports

[joeharb]

After more discussion the actual "vulnerability's" that are exposed are the following:

Dropbear SSH Multiple Security Vulnerabilities and Deprecated SSH Cryptographic Settings...

Per CSCug65382 there is no workaround for Dropbear and I don't think any loads have been release for phones that remove the following keys diffie-hellman-group1-sha1 cipher 3des-cbc cipher blowfish-cbc.

Not sure how to proceed other than the ACL.

[HARIS_HUSSAIN]

Block the Port 22 from and to IP Phone subnet via ACL or Firewalls.

*** Please rate helpful post; Mark "Accept as a Solution" if applicable

Thanks,
Haris