Security issues with phones

[poynter.net]

Had a pen test done of the network and a lot of issues were raised with weak SSL on Snom320.

I understand these are end of life but any opinions on if this actually causes a potential security issue?

Also raised that SSLv3 is enabled on a Yealink T42S, which is a supported, upto date model. It also supports weak and medium strength cipher suites, weak hashing algorithm & EXPORT_RSA (FREAK) vulnerability.

This seems more concerning, is this todo with the phone, 3CX specific firmware or the provisioning? Will this be addressed with the update supporting S-RTP, etc. or will these weaknesses remain?

 

[Paul@ISO]

Any update on this issue? Seeing the same thing even after getting Update 6

 

[cobaltit]

@poynter.net

Network segmentation is the answer. I would assume you know this if you are getting a pen test. Is there some requirement you are trying to meet?

@Paul@ISO

What exactly were you expecting the 3CX Update to fix on the phones? Do you also have Snom320 phones? This is very clearly a phone issue first and foremost. While provisioning changes might be able to disable some protocols for the most part this is going to be a firmware requirement to remove obsolete protocols and/or update things like the included SSL libraries. Clearly not going to happen for EOL phones and frankly I wouldn't expect anything to be up to snuff except from someone with enterprise aspirations (Cisco and Polycom). I would treat phones like IoT devices which only care about functionality and ease of use at the expense of security. Isolate from anything you care about and call it a day.

 

[Paul@ISO]

No we're running Yealink T46G phones, fully supported. There appears to be some config file changes available to disable the weak cipher suites; however, these hooks are not listed on the default T4X template and we're wary about adding additional lines.