Observing vulnerability in WLC(AIR-CT5508-K9)

[csawest.dc]

HI All,

We are observing below vulnerability in WLC(AIR-CT5508-K9)

Product Version : 8.2.151.0 

TLS/SSL Server Does Not Support Any Strong Cipher Algorithms

Weak Cryptographic Key

TLS/SSL Server Supports The Use of Static Key Ciphers

Self-signed TLS/SSL certificate

Untrusted TLS/SSL server X.509 certificate

SHA-1-based Signature in TLS/SSL Server X.509 Certificate

X.509 Certificate Subject CN Does Not Match the Entity Name

Please suggest . Thanks !!

[Leo Laohoo]

Go HERE.

[Karsten Iwen · Accepted solution]

There is still something you could do here:

1. Upgrade to a more recent version
2. disable legacy crypto: "config network secureweb cipher-option high enable"
3. Replace the certificate with a correct and trusted one.

But as always, be aware of the consequences (at least with "2.") ... 

[jhonwellLorente57911]

HI Team,

Anyone could help me on this?

We are Also observing below vulnerability in WLC(AIR-CT2504-K9)

Product Version : 8.5.160.0

TLS/SSL Server Does Not Support Any Strong Cipher Algorithms

Weak Cryptographic Key

TLS/SSL Server Supports The Use of Static Key Ciphers

Self-signed TLS/SSL certificate

Untrusted TLS/SSL server X.509 certificate

SHA-1-based Signature in TLS/SSL Server X.509 Certificate

Appreciate your prompt response. TIA!

[Abdullatif]

Hi,

can you help on how to fix this vulnerability on cisco WLC "Weak Cryptographic Key" .