How to (not) fix a security flaw

How to (not) fix a security flaw

A pair of flaws in the web interface for two small-business Cisco routers make for a prime example of the wrong way to go about security fixes. Beyond that, an additional information disclosure flaw, related to CVE-2019-1653, was reported; it uses a debug interface to retrieve a (gzipped tar) file, encrypted with a known, hard-coded password, from the device. There is probably not much in the way of proprietary “secret sauce” in the web interface, but an open-source release might be problematic for other reasons; Cisco would also have to provide ways for users to upload changes to the router, which may have its own set of challenges.

Source: lwn.net