Re: Beware of RV220W firmware 1.0.4.17

Joergen Thomsen · ‎08-22-2012

There are still some old and new issues. This should not be so at a previously highly rated router manufacturer as Cisco.

1) Please, observe, that after a firmware upgrade from 1.0.3.5 to 1.0.4.17 it was needed to delete all the access rules and create them again to make sure, they were all working We had 40+ rules and were down for some several hours until this was detected. Outbound traffic was working.

Quite frankly: this has been seen before and why has Cisco not addressed this ? A smooth upgrade is expected by the customers.

2) The firmware is released with a reissued certificate with the same serial number.

This is bad practice and should simply not happen

It is preventing access to the router from e.g. the Firefox browser.

Old Certificate:

Data:

Version: 4 (0x3)

Serial Number: 14872231 (0xe2eea7)

Signature Algorithm: sha1WithRSAEncryption

Issuer: CN=588D09E2EEA7, OU=RV220W, O=Cisco Systems, Inc., C=US

Validity

Not Before: Mar 13 02:40:08 2009 GMT

Not After : Mar 11 02:40:08 2019 GMT

Subject: CN=588D09E2EEA7, OU=RV220W, O=Cisco Systems, Inc., C=US

New Certificate:

Data:

Version: 3 (0x2)

Serial Number: 14872231 (0xe2eea7)

Signature Algorithm: sha1WithRSAEncryption

Issuer: CN=588D09E2EEA7, OU=RV220W, O=Cisco Systems, Inc., C=US

Validity

Not Before: Jan 1 00:00:15 2011 GMT

Not After : Dec 29 00:00:15 2020 GMT

Subject: CN=588D09E2EEA7, OU=RV220W, O=Cisco Systems, Inc., C=US

https://support.mozilla.org/en-US/kb/Certificate%20contains%20the%20same%20serial%20number%20as%20another%20certificate

3) The hair-pinning problem is still not solved saticfactorily.

All access from the LAN using public IP-adresses have the internal IP address of the router as the source address

I have not tested extensively yet, but at least now the IPv6 tunnel does not have to be restablished after a reboot and the NTP time settings seem to have been fixed.

linksysinfo · ‎08-22-2012

Joergen Thomsen wrote:

There are still some old and new issues. This should not be so at a previously highly rated router manufacturer as Cisco.

1) Please, observe, that after a firmware upgrade from 1.0.3.5 to 1.0.4.17 it was needed to delete all the access rules and create them again to make sure, they were all working We had 40+ rules and were down for some several hours until this was detected. Outbound traffic was working.

Quite frankly: this has been seen before and why has Cisco not addressed this ? A smooth upgrade is expected by the customers.

Just some info for other users...

If you are deploying any update to a live system then you should either NOT upgrade untill all facts are known or you have run a test against some devices already. what happens if your router fails? do you have a spare? if so test the upgrade on that. if you dont have a spare then the live system is dead until a replacement is gained.

Personally the amount of changes on this firmware update should really make a full reset before/after the upgrade.

I'll list the known changes here in a moment.

Anyway just my two cents worth....

Regards Simon

http://www.linksysinfo.org

Regards Simon

Joergen Thomsen · ‎08-22-2012

Yep, that's the right way to do it. Just blame the customer and assume no responsibility for bad craftmanship.

linksysinfo · ‎08-22-2012

SPR Cisco CDET Description

--- ---------- ----------

30606 Dnsmasq process not running after uploading customer configuration

CSCua79476 Summary:upgrading from fw 1.0.3.5 to fw 1.0.4.15 causes connection issue where router becomes inaccessible

32569 DHCP option 150 is not getting configured in the backend and device is not responding for DHCP option 150 request from client.

22224 Device is accepting 64 characters for password field in 'change password' page.

23288 Validation of meridian field is not proper in wireless active time page, when both the start and stop

24788 CSCtn81241 GUI is showing blank page when user try to login to the device using IPv6 address with I.E. browser

25252 Problem routing TCP traffic in VPN(SSLVPN Over IPSEC)

26009 CSCtr39253 Need to allow user to upload self signed certificate in both self and trusted area.

26304 Unwanted error message observed when we click back button in wireless->edit security mode page

29213 In the system summary page, in the wireless section there is a profile name column present

29222 After operation succeeded message navigation warning message should not be observed in wireless secur

29768 Able to see inverted question mark(?) before the string in content filtering page.

29997 In the help pages "contents" heading is not completely displayed with Firefox browser

30013 SSL VPN Client portal,ipv4/ipv6 routing tables display,output of ping/traceroute/lookup help pages ar

30014 Go button is not working in all the help pages.

31251 CSCtz38609 Inbound rules are getting flushed automatically with the customer provided configuration

31362 Inbound firewall rules based on portforwarding rules are not getting up in the backened with customer

31458 No Reorder button found in IPv6 access rules page

31480 There is no provision to enable logging based on severity for Protectlink Facility in Add/Edit Loggin

31561 Device is not setting Dyndns account update after Dyndns update period is completed

31836 When DST for Central European Time is selected, then time is advanced by 7 hours instead of advancing

31995 Memory percentage is not shown accurately in Dashboard page.

32097 Unable to establish Quick VPN tunnel from Windows XP 32bit host.

32289 Unable to establish Quick VPN tunnel after changing password from the client.

32428 "i8HTMl missing" message is observed, in vpn users page

32542 Unable to connect wireless clients to the WPA/WPA2 configured Access points in B/G mixed mode

32796 Support to generate self sign certificate within the router

32868 issue related to related to the HREF link in OLH pages