Dump these small-biz routers, says Cisco, we won't patch their flawed VPN

https://www.theregister.com/2022/09/08/cisco_routers_vulnerability/

by sorenjan • 4 years ago

59 78 4 years ago

theregister.com

xani_• 4 years ago

scratches off Cisco from vendor list

"Oh, that's not what you meant ? Well, the others are cheaper so byebye anyway"

bluedino3• 4 years ago

Cisco's small business line is overpriced junk anyway. The Cisco name is supposed to make you feel better, or something.

RajT88• 4 years ago

Yep. I quit buying Cisco small business stuff 13 years back. They have done many things more egregious than this.

wongarsu2• 4 years ago

Apparently Cisco's great if you deploy a couple of them, everything working seamlessly together with one management software. If you pony up for their licenses that is.

For anything smaller that doesn't need that, I don't see the point in buying (new) Cisco hardware.

sigio• 4 years ago

For small-office and home use I only use routers that run OpenWRT, at least there you can always get fixes, and it runs a very plain linux system.

Current favourites are tplink-archer-c7, edgerouter-x, asus rt-ac85p ... all of these retail for about $60 and are more then capable enough to route a gigabit at linerate and do stuff like wireguard.

somat• 4 years ago

I think the main thing is to have your router software vendor be different than your router hardware vendor.

My current favorite small business router is the pcengines apu2 family. I run openbsd on them. but really it could be anything. great little boxes.

numpad02• 4 years ago

These are basically branded swags. I wouldn’t expect Boeing keychain from their company store to have gone through Boeing engineering process and quality control, same deal but it happens that with electronics manufacturers, some souvenir grade items assume the same role as regular products.

nigma13373• 4 years ago

I mean, isn't it quite reasonable to not update something post-EOL ? (router EOL of 5 years seems a bit short though)

twawaaay3• 4 years ago

But that's the whole point.

Imagine you have to throw out your car after 5 years because the manufacturer stopped updating the software. We are getting there.

5 years is not nice. A large, established company like Cisco, selling devices in an established and very slowly evolving market like routers to companies, should be offering much longer support periods.

Apple supports iPhones for 7 years which I still think is not enough. I think routers for small businesses should be supported for at least double that.

There is physically nothing wrong with these routers. They are perfectly capable doing their job from every possible angle. This is just generating garbage so that Cisco can sell more new hardware that is performing basically the same job.

ThreePinkApples2• 4 years ago

Apple supports iPhones for 7 years

That's 7 years from launch, not 7 years from end of sale.

Not defending Cisco here, but looking up the RV110W I can find documents for it dating back to 2011, so that's 11 years of support.

For the RV130 I can find an administrators guide that was revised in Aug 2014, so at least 8 years there. probably more given that it's a revision.

wccrawford• 4 years ago

First off, I think this is awful of Cisco, and definitely harms their brand in my opinion. I already didn't think well of them for low-end stuff, though, so it's not like they could do much damage there.

However, this isn't killing the entire router. Just the VPN functionality. If you don't use that, there's no need to get rid of the router. Just make sure the VPN is disabled, as per the article.

If you do use the VPN, then you should either replace the router or implement the VPN differently. Second-hand, that router is still good for anyone that doesn't need a VPN.

When tech is moving fast, I can understand a short warranty, but I don't think routers are in that category. (Wifi routers are, but I've yet to have a Wifi router that could handle my residential usage of it anyhow. They always end up having problems. I've moved to having an access point separately from a router so at least it doesn't kill the whole network when it gets stupid.)

magicalhippo2• 4 years ago

I think Microsoft has a better approach for Windows. They deliver regular updates for N years, but security updates for a lot longer. I agree it's fine not to deliver regular updates after EOL, but for critical security vulnerabilities, I think they could do a lot better than just 5 years.

After all, it's not exactly environmentally friendly for working hardware to get ditched just because of some software turns it useless.

nigma13373• 4 years ago

I totally agree, and stopped buying cisco a long time ago. 5 years is too short, i think i've had my current router for 10 already.

The EOL sucks, but that's what people kinda signed up for with Cisco.

mellavora• 4 years ago

Like, for example, if that hardware happens to be the hospital's MRI scanner.

pessimizer4• 4 years ago

I mean, isn't it quite reasonable to not update something post-EOL?

EOL isn't real, it's made up. Broken or not powerful enough anymore is real. The town crier could decide to blow a trumpet and proclaim "EOL" a week after the last one is sold.

nigma13373• 4 years ago

ofc it's real. They're saying "at this date, we wont update it anymore". The router still works, it just isn't updated anymore.

If i had an old product, there's also some point where i'd say "I wont be updating this anymore", as to phase it out. Expecting something to receive active support forever is unreasonable.

tinus_hn• 4 years ago

It’s business hardware so the support term is predictable and known at the time you buy the device. In the case of Cisco it’s 5 years from when the device is discontinued.

But then small businesses like to cheap out and gamble on a device that has a short time of support left and complain when it ends.

This is not a surprise, except if you chose to put on a blindfold yourself. And if you think EOL of 5 years is too short, don’t buy a device with an advertised EOL of 5 years.

Arnt2• 4 years ago

EOL today for routers sold in 2017 is harsh.

EOLing a laptop that's hauled around is one thing, or a server with a CPU that's configured to run at the limit of what its cooling system supports. But routers are little boxes that run at very conservative clock speeds and a correspondingly high MTBF, are never moved, never reconfigured, never given new software to run, and to which its users hardly ever pay attention. Five years is unreasonably short for that kind of device.

orangepurple• 4 years ago

How else is the Cisco executive team supposed to get paid?

yjftsjthsd-h• 4 years ago

Routers also tend to be used by small businesses that stick them in a closet and forget they exist, or large businesses that can't afford the downtime of replacing the whole stack. I suspect a lifetime of 5 years is actually on the low end.

Arnt2• 4 years ago

That's more or less what I tried to say. Assuming a five-year lifetime shows a lack of knowledge of how the product is typically used.

Incidentally, my own upstream uses a twelve-year-old router. I know where it is but I'm not sure that cupboard has been opened this year.

themoonisachees• 4 years ago

I used to work at a small shop and we would sell stormshield small-biz routers. The typical time we'd sell to the client was 10 years, and the old routers we would cycle out were about 7-12 years old (by that point considered really old). If i sold a router to my client and 5 years later it's EOL, that client is not gonna be happy with me.

bluedino3• 4 years ago

It's even worse in the concept of `router == firewall`

If you buy one of the popular firewalls, you need a subscription for it to actually work. Once it's expired, you lost your web filtering and IPS and whatever 'modules' you've subscribed to using.

A 3 year subscription is often as much as the hardware.

It's kind of a waste, it'd be nice if there was a OpenWRT style firmware you could load on all the old Fortinet, Watchguard, Sophos, etc firewalls out there.

sekh60• 4 years ago

There is plenty of white box switches and routers you can load things like Vyos or cumulus Linux.

woliveirajr• 4 years ago

After the EOL all companies should make the {thing} open : release all keys, software, backdoors, whatever. No more copywrite, IP, on it.

So that any user could install anything they wanted and use it as they wish. Including replace components with similars and/or make modifications.

White_Wolf• 4 years ago

This should be mandatory for any product/software that becomes EOL with no exception.

denton-scratch• 4 years ago

Strikes me it's probably impossible. Cisco is presumably bound by all kinds of tech cross-licensing deals, and can't just open up schematics, source etc.

carlmr• 4 years ago

After the EOL all companies should make the {thing} open : release all keys, software, backdoors, whatever. No more copywrite, IP, on it.

I think this is reasonable.

It's unreasonable to expect companies to support old products indefinitely, otherwise they would collapse under the weight of the legacy.

It's also unreasonable to leave customers that bought something, however old, with nothing to fix it themselves.

Ideally also the companies would have to release all this at least a year before EOL for people to be able to get acquainted with the codebase.

bluedino3• 4 years ago

Would repercussions would that have on the existing userbase?

numpad02• 4 years ago

From the article, affected models are: RV110W, RV130, RV130W, RV215W.

Cisco branded, but appears not what an network engineer might consider as such; these are Linux-based routers. Cisco routers and switches are based on their proprietary chipset and proprietary IOS/IOS-XR/IOS-XE/NX-OS operating system. Without it, I would rather pick ASUS or anyone else.

brnt• 4 years ago

Protip: buy a router that has good openwrt (et al) support. Your hardware will live a longer and more fulfilling life!

tucosan• 4 years ago

Open source OS should be the industry standard for network hardware.

cesarb2• 4 years ago

And make sure it has at least 16MB of flash and 128MB of RAM, if you really want it to have a long life. See https://openwrt.org/supported_devices/864_warning for details.

andreareina• 4 years ago

They're becoming rarer and rarer. Bought a router three years ago, could only find one model sold locally that had openwrt support. Except for the latest revision, which of course is all that was available.

thrtythreeforty• 4 years ago

There's tons of perfectly functional corporate e-waste on eBay that supports openwrt, especially cloud-managed crap like Meraki that was junk when it was new. Nobody has any use for out-of-support routers, so really nice hardware (PoE, Wi-Fi 6, etc) can be had for $20 and an hour of pwning the stock image.

I hate on Meraki so much because it's the epitome of something that doesn't need to be a paid subscription except for juicing customers (the hardware is great). Ubiquiti does cloud-managed the right way; you can self host and the hardware isn't bricked if you let maintenance lapse.

nerdponx2• 4 years ago

I'm lately finding it hard to convince myself that there is a not a global conspiracy among large corporations to implement the "you will own nothing" directive by means of a ratcheting system.

One big company rolls out an anti-consumer, anti-ownership, anti-freedom policy. People get annoyed and some small subset of customers leave, while the rest maybe grumble but stay. Then the next-biggest companies see that the big player is still doing fine with their anti-consumer policy, so they get a little greedy and start doing it too. Then all of a sudden it's a new industry standard, and consumers who value their own freedom find themselves rapidly running out of alternatives.

Maybe if outcry gets really bad, the big corp need to roll back the decision, and either wait for a different opportunity, or let another corporation take the lead, or change the type of policy to be more subtle.

My personal system for evaluating a conspiracy theory is: 1) how big is the payoff? 2) how hard is it to execute? 3) how hard is it to keep secret? 4) how many people need to be involved?

This scenario passes all 4 criteria with flying colors. 1) The payoff is absolutely enormous. 2) It would be relatively easy for the same people who would be most strongly motivated to do this. 3) It should be easy set up a communication system that maintains almost total plausible deniability against collusion, because it actually only requires minimal knowledge of and cooperation between participants and their plans. Just a few meetings among subgroups of participants, and more head nods than spoken words. During the process, active communication can be reduced to basically zero. 4) Very few. Most corporate decision makers at most companies wouldn't have to know, they'll be able to see where things are headed and follow along. In general, the only holdouts will be HN poster types with small businesses that serve only tiny fractions of the market.

bombcar2• 4 years ago

It’s even scarier - you don’t need any conspiracy or communication at all - companies trying to move to “aaS” models with subscriptions will naturally cause this with no collusion at all.

MyBallsAreSexy• 4 years ago

You can't even really own your computer anymore if you're a windows user. The entire operating system is "as a service" and windows 11 makes that even more true.

pessimizer4• 4 years ago

They shouldn't be expected to update these for as long as they're useful. They should be required to open up the hardware if they refuse to update the software. That should be the rule: you get to pretend that locking people out of the hardware is for their own good as long as you continue to update their software for free. You can't just be allowed to arbitrarily EOL perfectly functional hardware.

ElCheapo• 4 years ago

In all fairness, as longs as patents exist you simply can't "open up" a piece of technology. What you can do is reverse engineer it, since it's allowed becausenof the manufacturer's drop of support

causi• 4 years ago

In all fairness, as longs as patents exist you simply can't "open up" a piece of technology

That's not true at all. Divulging data without offering license terms does nothing to hurt your ability to enforce intellectual property rights. The people using that data just do so knowing they're technically breaking the law. Patents are not trademarks.

wongarsu2• 4 years ago

Unlike trademarks, you can selectively enforce patents without risking them.

And in a way, the patent system is exactly about "opening up" technology. After all the idea of a patent is "you tell everyone how to build it, in return nobody is allowed to use that knowledge commercially for X years unless you allow it. This aligns great with "give us the tools to modify the software of hardware you find commercially unattractive".

bzxcvbn• 4 years ago

I don't really understand your comment. The whole point of a patent is that the description of the invention is made public. If you don't even want your competitors to know how you do it, then you keep the IP as a trade secret, but then you can't enforce a non-existent patent.

Volundr• 4 years ago

5 years is also shockingly short to me for a piece of networking hardware. One more reason to avoid Cisco.

illiac7863• 4 years ago

Please provide examples?

thunderbong• 4 years ago

I totally agree. Not to sidetrack your assertion, but even Google and Apple do this for their mobiles. Perfectly usable old mobile phones don't run the newer version of the apps at all.

This seems to be more and more prevalent even in other areas like washing machines, microwaves and even cars. I don't get old parts. Even the service technicians throw up their hands and say "Just buy a newer model".

bombcar2• 4 years ago

The problem with the parts is once the machine is no longer being made, they stop making the computer board for it, and the part inventory dwindles.

And when it’s $300-400 for a computer board, you might as well get a whole new machine.

The only way I’ve found to counteract that is to look for commercial or commercial-based units that share parts for years or more. But this can be harder for some classes of equipment ( commercial ovens are NOT at all like residential - they’re usually not insulated) but it can be a start.

zibby8• 4 years ago

Apple seems pretty good at keeping old phones up to date. The iPhone 6S is still supported, which was released 7 years ago.

lazyier• 4 years ago

If you are buying a Cisco router you are buying a closed source product. Why would you expect them to open source anything when you are happy to give them money for closed source firmware?

You are literally paying them for being closed source.

Stop rewarding these corporations for screwing you over and they will cease to screw you over. Either they will change their ways or go out of business if enough people feel the way you do. And, regardless, you would have solved these sorts of problems for yourself long before that happens.

It's been a very long time since Cisco was the only game in town for enterprise networking. Companies like Broadcom have released powerful ASICs that allows practically anybody to build a high performance routers and switches.

salawat• 4 years ago

I would not hold up Broadcom as being any better than Cisco in the openness department. If anything it's just more of the same, which while it technically satisfies the definition of competition, does not largely modify the lands ape of networking dedicated hardware in the more open direction.

Kinrany• 4 years ago

Relying on people to magically solve tragedy of the commons by themselves never works.

nsteel• 4 years ago

Don't Cisco use those exact Broadcom chips in these types of low-end products? A high-performance chip is just one part of the product, you need software also.

hansel_der• 4 years ago

true

hyperscalers got into building their own switches a decade ago. whitelabel silicon and software _IS_ available, but the entrenchement is still huge as noone ever got fired for buying cisco.

cesarb2• 4 years ago

Networking hardware has a very long life.

At a previous company, we used in the office as the center of the LAN a switch (Cisco Catalyst 3548 XL) which was already past EOL. In fact, it was so long past EOL that the switch model which replaced that model was also already past EOL. And yet, it worked perfectly (other than a couple of failed ports), and we probably used less than a tenth of its capabilities. I wouldn't be surprised if that same switch is still working today; the main reason to replace it would be that it only has Fast Ethernet (100baseTX), instead of the current mainstream default of Gigabit Ethernet (1000baseT).

Intermernet• 4 years ago

Many years ago I reported a bug with Cisco ios routers where the default admin login worked in the sdm web gui even after the account was deleted. I received no acknowledgement that the problem existed. After paying the support subscription, a year later the problem was silently resolved. I lost all trust in Cisco after that.

lizardactivist• 4 years ago

Some of these security issues really look like backdoors.. very odd

shrubble• 4 years ago

Cisco's Meraki line is explicitly designed to not pass traffic after the license/entitlement expires. That neans that an expensive 24 port managed switch for example, will brick itself after 7-10 years of life.

Dump these small-biz routers, says Cisco, we won't patch their flawed VPN

Related Stories