Latest Penetration testing, there are some vulnerabilities discovered

[arumugasamy]

In the latest Penetration testing, we have there are some vulnerabilities discovered on some IPT IPs. The CUCM and CUC running with version 11.5. How we can mitigate the vulnerabilities. Will they all be solved by upgrading to the 14.0 version?

1. Configure the affected services to drop support for weak cipher suites and enable support for stronger cipher suites. See the full report for detailed remediations.

2. Replace the affected certificates

3. Configure the affected services to support newer protocols. See the full report for detailed remediation information.

Above 3 are to be resolved.

[Jonathan Schulenberg]

You will need to research the specific CVE and corresponding Cisco PSIRT to identify the fixed in version.
As for other three:

• I suggest starting with the security guide. Again, it’s on you to qualify that nothing in the environment requires the older ciphers or TLS versions. Be careful - it’s very easy to break stuff here - especially if you have anything end of sale. Often times this requires a PCAP of the TLS handshake to investigate proactively.
• Certificate renewals have been discussed at length on the community; please check the documentation (one of several guides on the topic) and previous threads. Be careful not to break your ITL trust though!
• Not sure what you’re referencing here.

[arumugasamy]

Thank you so much.

Let me go through your document