Cisco Meraki MS390 SNMP Vulnerability

Condition to be vulnerable

This vulnerability affects Meraki MS390 switches that are running a firmware release prior to 14.32, while also having a Layer 3 Interface configured. 

To determine whether a device has a Layer 3 Interface configured, administrators can follow one of the below steps:

1. Navigate to Switch > Configure > Routing and DHCP.

   1. If the Routing and DHCP page states “You don't have any interfaces or static routes configured” as shown below, it implies you do not have any Layer 3 interfaces configured for your network and hence the device is not exposed to this vulnerability.
                        

   2. If the Routing and DHCP page has an entry under the Interfaces section for an MS390 switch, it implies you have Layer 3 interface(s) configured. Hence, the device is exposed to this vulnerability.

2. Another way to confirm Layer 3 interface configuration is by navigating to the specific Switch details page. Switch > Switches > Select a specific Switch > L3 Routing tab which should specify whether L3 routing is enabled or disabled on that particular switch. 

   1. If Layer 3 routing is enabled, this implies you have at least one Layer 3 interface configured on this switch and hence the device is exposed to the vulnerability.

   2. If Layer 3 routing is disabled, this implies you do not have any Layer 3 interfaces configured on this switch and hence the device is NOT exposed to the vulnerability. 
      
      Devices that are running an affected firmware release will only be exposed to this vulnerability once a Layer 3 interface is configured.

Solution 

Meraki has fixed this vulnerability in MS firmware 14.32 and later and customers must upgrade to benefit from the fix. 

Workaround and Mitigation

Although there are no workarounds or mitigations for this vulnerability, customers who do not use SNMP as a feature may apply a Network Access Control List (ACL) to prevent inbound SNMP traffic from being processed. As another option, customers that do not use Layer 3 routing capabilities may remove L3 interfaces from their network. Either of these options will remove the attack vector.

1. To configure an ACL from the Meraki dashboard, navigate to Switch > Configure > ACL.

2. Administrators should create and add two rules to prevent SNMP traffic from being processed. For each ACL rule, they should deny IPv4 traffic destined to UDP source port 161 

3. Define the policy, IP version, source IP address or subnet, source port, destination IP address or subnet, destination port, and VLAN. You also have the option to describe the rule in a comment section.

Information on how to configure an Access Control List can be found in the Knowledge Base Article Configuring ACLs

While these remediation actions have been deployed and proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround, mitigation or remediation action that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds, mitigations or remediation actions before first evaluating the applicability to their own environment and any impact to such environment.