The following vulnerabilities were identified: 1. Weak TLS/SSL Ciphers 2. TLS 1.3 Not Supported 3. TLS 1.0 Enabled
Hi @Jerayuth, The SmartZone is on an older 6.1.2 build. As the first remediation step, we recommend upgrading the SmartZone to the latest available 6.1.2 Patch 6 release, as security and fixes/enhancements are included in the newer releases.
After the upgrade, we recommend running the vulnerability scan again to verify the reported findings.
If the scan reports any of the above vulnerabilities after upgrading, please provide the vulnerability report, including the affected port/service and the exact TLS/cipher identified. We can then review whether the finding applies to the SmartZone service and determine the appropriate remediation. Note: This will be a direct upgrade from the current version to the latest version(6.1.2.0.1105). Please perform a cluster and config backup before the upgrade. Thank you! Amith
Hi @Jerayuth Please find the below answers to the issues you have mentioned.1. TLS 1.3 Not Supported : TLS 1.3 is supported only on 7.1.x & 7.2.x FIPS version of vSZ. And not on normal vSZ. This is currently a feature request in place.2. TLS 1.0 Enabled : This can be disabled in vSZ using below command vSZ-H-36(debug)# no tlsv1 Here is the article for full process. https://support.ruckuswireless.com/articles/0000097743. Weak TLS/SSL Ciphers : Please share the details about the exact cipher suites detected. We need the actual scanner information to identifying what cipher and port caused the finding. Based on that it will help us to tell the action plan weather to upgrade or can be fixed in existing version. Let us know if you have any queries or need any assistance.
@Jerayuth Alternatively you can also open a support case if you need any assistance with software upgrade or want to share the scanner report.
