CSCvb29204 - BenignCertain on IOS and IOS-XE

[NetworkAdmin2]

Hi 

When nessus scan, we got vulnerability info as below. Any solution can be used for this issue? 

A remote device is affected by an information disclosure

"The IKE service running on the remote Cisco IOS device is affected by
an information disclosure vulnerability, known as BENIGNCERTAIN, in
the Internet Key Exchange version 1 (IKEv1) subsystem due to improper
handling of IKEv1 security negotiation requests. An unauthenticated,
remote attacker can exploit this issue, via a specially crafted IKEv1
packet, to disclose memory contents, resulting in the disclosure of
confidential information including credentials and configuration
settings.

BENIGNCERTAIN is one of multiple Equation Group vulnerabilities and
exploits disclosed on 2016/08/14 by a group known as the Shadow
Brokers."

"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCvb29204."

Current Version:15.0(1)M5 and device model:CISCO1905/K9

[marce1000]

                       >...Any solution can be used for this issue? 
  -        Upgrade to one of the Known Fixed Releases in the bug report , 

 M.

[NetworkAdmin2]

Hi,

We checked in below URL,  but we didn't get proper version to upgrade 905 router

 https://sec.cloudapps.cisco.com/security/center/softwarechecker.x?productSelected=ios&selectedMethod=A&captchaPage=true&platformCode=NA&versionNamesSelected=15.7(3)M9&allAdvisoriesSelectedByTree=N&advisoryType=0&iosBundleId=cisco-sa-20240327-bundle&... 

 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20160916-ikev1.html

 https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb29204

[marce1000]

               - FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb29204
                                  >...Look for Known Fixed Releases

 M.