CVEs, Patch Management, and a War zone

General
1

OK, so a bit of a baity headline, but we all know the internet is basically a war zone right now.

Peplink, I think you were a bit slow on CVE-2026-98432 given how many devices it affects across the product range. “We are investigating…” with two days of silence for such a large vuln isn’t great. I do appreciate and assume that the engineering team at Peplink was working extremely hard to get all of the necessary builds created and QA’d, but comms to distributors or partners about what’s coming and what the status is will be critical as the internet becomes more of a war zone.

More importantly, we (network/system admins) need a scalable and/or scriptable way to apply firmware updates. It is painful to update custom firmwares across many subsets of devices across organizations. When you’re a partner that manages dozens to hundreds of organizations and pretty much every product across the spectrum, it’s daunting! But hey, I never complain without a recommendation or offer for help :slight_smile:

I think there are two possible solutions that aren’t necessarily mutually exclusive:

  1. Special builds should not be used for rapid security releases. Semantic versioning principles state that builds should be [major].[minor].[patch], but Peplink uses the Patch tuple as more of a sub-version, which is cool. However, as you did with ICVA releases for these patches, you can use a fourth tuple to push a “new” version and allow it to be selectable in the dropdown in InControl2

  2. Expose an IC2 API endpoint (I couldn’t find one in the docs) to update firmware for orgs, groups, and individual devices. I understand this is not a small effort given exceptions, validations of custom firmware URLs, scheduling, etc., but again, the internet is a warzone. It’s only a matter of time before some vulnerability is discovered that is widely exploited and affects Peplink devices (among everything else), and patching in minutes via API and scripting versus hours of point and click, copy and paste, will actually make a difference.

/me steps down from soap box

Thanks y’all :slight_smile:

7 Likes
2

Editing to add some thoughts around special builds:

Special builds are just that: special. It is not (nor should it be) “special” to patch a CVE. When a user open a box and updates the firmware to the latest version they should be confident in the generally understood fact that “latest version” has all of the latest features, fixes, and security patches. By using a special build, you are requiring a user to 1) know about and 2) find a special build/release, but most importantly, 3) know how to install it.

Imagine if you have a new user who purchased your device and upgraded using IC2 or the local device admin to the “latest” version, only to be compromised by a security vulnerability that required them to find and download from a forum post to patch against. Not great.

1 Like
3

This is an extremely common occurrence we see. Users simply use the built in firmware update to check for any updates and if nothing is returned, they expect they are on the latest with no further investigation. Nor should they be expected to at that point.
Special build postings in the forum require the user to first be aware there is an issue and all too many users are oblivious to vulnerabilities as it isn’t their realm to stay in the know.

I love the idea of a fourth tuple! This would’ve been helpful a few times in the past that I can recall.

1 Like