| V-4582 | High | The network device must require authentication for console access. | Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to... |
| V-3056 | High | Group accounts must not be configured or used for administrative access.
| Group accounts on any device are strictly prohibited. If these group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having... |
| V-3143 | High | The network element must not have any default manufacturer passwords. | Network elements not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of... |
| V-3210 | High | The network element must not use the default or well-known SNMP community strings public and private. | Network elements may be distributed by the vendor pre-configured with an SNMP agent using the well known SNMP community strings public for read only and private for read and write authorization. ... |
| V-3175 | High | The network device must require authentication prior to establishing a management connection for administrative access. | Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling... |
| V-3069 | Medium | The network element must only allow management connections for administrative access using FIPS 140-2 validated encryption algorithms or protocols. | Remote administration using non-FIPS 140-2 validated encryption is inherently dangerous because anyone with a sniffer and access to the right LAN segment can acquire the device's account and... |
| V-14671 | Medium | The network element must authenticate all NTP messages received from NTP servers and peers. | Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP... |
| V-14717 | Medium | The network element must not allow SSH Version 1 to be used for administrative access. | SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now... |
| V-25322 | Medium | The perimeter firewall must be configured as required for the dedicated Internet-only WLAN infrastructure subnet. | If the perimeter firewall is not configured as required, users connecting to an access point may be able to compromise internal DoD information systems. |
| V-3057 | Medium | The network element must have all user accounts assigned to the lowest privilege level that allows each administrator to perform his or her duties.
| By not restricting administrators and operations personnel to their proper privilege levels, access to restricted functions may be allowed before they are trained or experienced enough to use... |
| V-3014 | Medium | The network element must timeout management connections for administrative access after 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network... |
| V-28784 | Medium | A service or feature that calls home to the vendor must be disabled.
| Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that... |
| V-3967 | Medium | The network element must time out access to the console port after 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port... |
| V-17821 | Medium | The network element’s OOBM interface must be configured with an OOBM network address. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM... |
| V-17822 | Medium | The network elements management interface must be configured with both an ingress and egress ACL. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-14888 | Medium | The WLAN inactive session timeout must be set for 30 minutes or less. | A WLAN session that never terminates due to inactivity may allow an opening for an adversary to highjack the session to obtain access to the network. |
| V-25316 | Medium | The password configured on the WLAN Access Point for key generation and client access must be set to a 14 character or longer complex password as required by USCYBERCOM CTO 07-15Rev1. | If the organization does not use a strong passcode for client access, then it is significantly more likely that an adversary will be able to obtain it. Once this occurs, the adversary may be able... |
| V-25315 | Medium | WLAN access point must be configured for Wi-Fi Alliance WPA2 security. | The Wi-Fi Alliance’s WPA2 certification provides assurance that the device has adequate security functionality and can implement the IEEE 802.11i standard for robust security networks. The... |
| V-25319 | Medium | WLAN access points and supporting authentication servers used for Internet-only connections must reside in a dedicated subnet off of the perimeter firewall. | If the access point or its supporting authentication server is placed in front of the perimeter firewall, then it has no firewall protection against an attack. If the access point or its... |
| V-5613 | Medium | The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface. | An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens... |
| V-5612 | Medium | The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. | An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and... |
| V-5611 | Medium | The network element must only allow management connections for administrative access from hosts residing in the management network. | Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted... |
| V-14004 | Low | WLAN equipment obtained through acquisition programs must be JITC interoperability certified. | Interoperability certification assures that warfighters can communicate effectively in joint, combined, coalition, and interagency environments. There is some degree of risk that systems without... |
| V-23747 | Low | The network element must use two or more NTP servers to synchronize time. | Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches,... |
| V-14846 | Low | WLAN SSIDs must be changed from the manufacturer’s default to a pseudo random word that does not identify the unit, base, organization, etc. | An SSID identifying the unit, site or purpose of the WLAN or is set to the manufacturer default may cause an OPSEC vulnerability. |
| V-14844 | Low | The relevant U.S. Forces Command (USFORSCOM) or host nation must approve the use of wireless equipment prior to operation of such equipment outside the United States and Its Possessions (US&P). | When using a wireless system outside of the US&P, host nation wireless spectrum regulations must be followed. Otherwise the system could interfere with or be disrupted by host nation... |
| V-7011 | Low | The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. | The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. ... |
| V-3070 | Low | The network element must log all attempts to establish a management connection for administrative access. | Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders... |
| V-14889 | Low | WLAN signals must not be intercepted outside areas authorized for WLAN access. | Vulnerability Discussion: Most commercially-available WLAN equipment is pre-configured for signal power appropriate to most applications of the WLAN equipment. In some cases, this may permit the... |
