The vulnerabilities we may come across during the penetration tests are as follows.
The lack of access control lists.
Network devices provide basic traffic filtering capabilities with access control lists.
Access control lists can be configured for all routed network protocols to filter the packets of those
protocols as the packets pass through a router.
You can configure access control lists at your router to control access to a network.
Access lists can prevent certain traffic from entering or exiting a network.
Insecure password methods.
While creating a credential for a network device, there might be more than one method to create the
password for the account, and some of these methods are not secure.
Either the passwords are stored and transferred as clear text, or they're encoded or encrypted by an
easy to crack cipher.
Web interfaces to manage the network device Using web services and interfaces to manage network devices
brings new responsibilities.
First of all, you should use Https instead of Http to avoid cleartext traffic.
Hardening the web application against the vulnerabilities such as SQL injection and XSS.
Implementing an appropriate authentication mechanism and access control are some other concerns of securing
a web application.
Insecure SNP versions.
SNP depends on secure strings or community.
Strings that grant access to portions of devices management plans.
Abuse of SNP could allow an unauthorized third party to gain access to a network device.
SNP three should be the only version of SNP employed because SNP three has the ability to authenticate
and encrypt payloads.
When either SNP one or SNP two are employed, like I was saying earlier, an adversary could sniff network
traffic to determine the community string.
You saw that happen?
You did it yourself.
This compromise could enable a man in the middle or replay attack.
Telnet.
Telnet data is sent in clear text.
So, as you know, a man in the middle is able to read the traffic.
It's certainly a good idea to use, for example, SSH to access network devices, especially when going
through a public network like Internet.
And as you're probably aware, SSH would encrypt all the data sent between the client and server.
And even if someone gets a hand on the data, it's of absolutely no use.
Non complex passwords.
Even if you use the right password methods, you should always use complex passwords because you are
always under the risk of password cracking attacks such as brute force and dictionary attacks.