sweet 32 vulnerability on port 16113 How to Address in cisco WLC

[AK002]

Team,

sweet 32 vulnerability on port 16113 How to Address in cisco WLC 2504 and 5508

Can any one came across this with any solution.

[Sathiyanarayanan Ravindran]

What is the code running on your controller?

Is it possible to share the complete vulnerability details?

[AK002]

Hi
Hi Sathiya,

Cisco 2500 wireless controller(software version 8.2.170.0) on ports 443 and 16113
Cisco 5500 wireless controller (software version 8.5.135.0) on ports 443 and 16113

After this command 443 is disabled but 16113 port still showing Vulnerability after security scan

config network secureweb cipher-option high enable and config network web-auth secureweb cipher-option high

[Leo Laohoo]

---

@AK002 wrote:

Can any one came across this with any solution.

---

SWEET32 is a very, very, very old vulnerability (LINK). 

Several firmware versions have already been released to fix this vulnerability.  

[AK002]

Hi leo,

Cisco 2500 wireless controller(software version 8.2.170.0) on ports 443 and 16113
Cisco 5500 wireless controller (software version 8.5.135.0)  on ports 443 and 16113

I seen that Bug ID already from the link which you have shared but what is the software version I need to upgrade

CSCvb48603

Known Affected Releases

8.0(140.0)

8.3(102.0)

[Leo Laohoo]

---

@AK002 wrote:

I seen that Bug ID already from the link which you have shared but what is the software version I need to upgrade

---

Use the LATEST train or version.  

[AK002]

Hi Leo,

The Latest train which they given is 8.4, That was already in deferral release train..

Also 5508 controller upgraded with 8.5.135.0, So from that bug information they have given only up to 8.4.. So need some suggestion after seeing that versions.

CSCvb48603

Known Fixed Releases

 8.4(100.0)

8.4(1.93)

8.3(114.11)

8.3(111.0)

8.3(104.128)

8.2(151.0)

8.2(145.25)

8.0(150.0)

[patoberli]

That means 8.5 is already fixed or was never affected by it, so is 8.2.170.0.

[Leo Laohoo]

As what Patrick (below) states, use the latest 8.5.X.X firmware.