In today's Security Now (June 24,2025) the show notes say
As we’re going to see at the end of today’s podcast, the flaws that were once present in Cisco’s Internet OS XE network devices were leveraged to admit the attackers into these networks. But Cisco had found and patched those vulnerabilities long before – as in years before – those flaws were used to gain illicit entry into these companies’ networks. ...
I’m at a loss to know how we can ever get this behavior to change. ... In a sprawling organization with thousands of routers and switches spread across a continent, where every device is receiving periodic updates, keeping everything updated – with the risk that an update might cause more trouble than the “potential trouble” it’s presumed to prevent ...
If large companies do not have the manpower or the will to update their assorted network devices, then I agree with Steve that things will not change. And, has he says, the more competent companies have to weigh the risk or updating with patches vs. not updating. In some/many cases an outage can not be tolerated.
The risk of installing updates can be greatly minimized on a device that has two copies of its firmware. Install version 8.4 and if it seems to cause a problem, reboot and fall back to firmware version 8.3. If the fallback is simple, fast and easy, then there is little reason to avoid updates (assuming a company has the manpower to make the updates at all).
On the router front Peplink devices have had two firmwares for at least 12 years, probably longer. Anyone know about pfsense or opnsense? There were a handful of consumer routers that also did this, but the feature was not front and center. I once ran across a Linksys router that could do this. In contrast, some devices NEVER let you fall back. Aruba may fall into that bucket (not sure).
Here is a screen shot of rebooting a Peplink router showing the two available copies of the firmware.
As we’re going to see at the end of today’s podcast, the flaws that were once present in Cisco’s Internet OS XE network devices were leveraged to admit the attackers into these networks. But Cisco had found and patched those vulnerabilities long before – as in years before – those flaws were used to gain illicit entry into these companies’ networks. ...
I’m at a loss to know how we can ever get this behavior to change. ... In a sprawling organization with thousands of routers and switches spread across a continent, where every device is receiving periodic updates, keeping everything updated – with the risk that an update might cause more trouble than the “potential trouble” it’s presumed to prevent ...
If large companies do not have the manpower or the will to update their assorted network devices, then I agree with Steve that things will not change. And, has he says, the more competent companies have to weigh the risk or updating with patches vs. not updating. In some/many cases an outage can not be tolerated.
The risk of installing updates can be greatly minimized on a device that has two copies of its firmware. Install version 8.4 and if it seems to cause a problem, reboot and fall back to firmware version 8.3. If the fallback is simple, fast and easy, then there is little reason to avoid updates (assuming a company has the manpower to make the updates at all).
On the router front Peplink devices have had two firmwares for at least 12 years, probably longer. Anyone know about pfsense or opnsense? There were a handful of consumer routers that also did this, but the feature was not front and center. I once ran across a Linksys router that could do this. In contrast, some devices NEVER let you fall back. Aruba may fall into that bucket (not sure).
Here is a screen shot of rebooting a Peplink router showing the two available copies of the firmware.
