JVN#29238389: IPCOM vulnerable to information disclosure

SSL Accelerator/SSL-VPN Function of IPCOM provided by Fsas Technologies Inc. contains an information disclosure vulnerability due to observable timing discrepancy (CWE-208).

Impact

Some of the encrypted communication may be decrypted by an attacker who can obtain the contents of the communication.

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.

Apply the workaround
Applying the following workaround may mitigate the impact of this vulnerability.

• Disable the RSA key exchange cipher suite in the IPCOM cipher suite settings
  For more information, refer to the information provided by the developer.

Products Affected

• IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301
• IPCOM VE2 Series V01L04NF0001 to V01L06NF0112