RV042 w/ firmware 4.2.3.06 "Server has a weak ephemeral Dillie-Heffman public key"

[Chinaski1]

Hi,

I'm running out of browsers that will allow me to connect to the RV042 web admin UI due to the SSL implementation on the RV042. The newest versions of Chrome and Firefox are refusing to connect and cannot be overridden. The official error is "ERR_SSL_WEAK_EPHEMERAL_DH_KEY" and the Chrome support doc is https://support.google.com/chrome/answer/6098869?p=dh_error&rd=1#DHkey.

Please tell me that Cisco is planning to address this asap. Thanks.

John

[Marijo Bartakovic]

Hi,

I'm having the same problem!

Please provide a fix asap.

Thanks,

Marijo

[Since1953]

Same problem. I used to be able to click "proceed anyway" but it looks like Chrome changed that in an update recently. I can still access in Microsoft Edge.

Please fix.

[celso.gomes420]

Just the same problem. Until last week I was using Safari and Firefox on OSX Mavericks, and both were connecting Cisco RV042 fine. Then I upgraded to OSX Yosemite (10.10.5) and Safari 9.0.1 / Firefox 42.0, and now I can't connect with no one. After all these complanings, shouldn't  Cisco release a patch to fix this?

[stephen.hale]

Seems to have taken effect in Chrome 45, IE 11 does still work for now but I'm not sure for how much longer.  I tried updating to the firmware to 4.2.3.06 when I saw the release notes indicated several fixes that sounded like they might resolve the issue. 

CSCus15224 Cisco RV042 Deterministic TLS Public Key Vulnerability.
CSCuo18668 OpenSSL upgrade to v1.0.1l.
CSCur53627 Fix SSL v3 (Poodle) Vulnerability.

Unfortunately nothing changed after the update and I still get the 

"Server has a weak ephemeral Diffie-Hellman public key (ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY)"  error message.  I have not yet tried resetting the router to defaults but that would be rather difficult since most of these routers are remote managed.   

[Bigoncisco]

Here is a link to an excellent article about the Server has a weak ephemeral Diffie-Hellman public key ... ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY error.

[stephen.hale]

Disabling the new SSL keys isn't the answer.  The issue here is that Cisco has not patched the RV042 and other RV0X series to use a 1024 bit or higher key.  Chrome 45, Opera, Firefox all block key sizes smaller.  Are there ways to get around this on some browsers.  Yes but you might as well just turn off SSL and instead of operating under the allusion of security. 

[Heron]

Same issue.

I am able to access with Firefox, but not Chrome and not Safari.

I have opened a ticket with Cisco regarding this. Will update if/when I get an update.

Max

[sportech62030]

I think that it's problem with Chrome....
Look at this:

https://productforums.google.com/forum/#!topic/chrome/o3vZD-Mg2Ic

Many people have problem with access to their routers, etc.

[Heron]

The issue appears to have resolved. Cisco provided a workaround (see the google product forums link from sportech62030 below). Though, before I could try it things started working again. Not sure if chrome autoupdated or not in the meantime.

[Angel Angelescu]

CISCO, if you do not fix this problem I will ask you for returning the product and give me my money back and I will also ask for a compensation for all the time I lose to buy another router and reconfigure the network. It is not possible for a company of this level to act this authistic.

[erickismyname]

I have same problem with the RV042.. after fixing the printer server in our PC server..

The network then having trouble as long with the router..

Browser issue:

Using the IP address of the router that has been already configured..

I cannot access with any browser:

     Google chrome errors "ERR_SSL_WEAK_EPHEMERAL_DH_KEY" 

     Firefox, Internet Explorer.

but I can now access the router in Firefox by changing the boolean value of security.ssl3.dhe_rsa_aes_128_sha and security.ssl3.dhe_rsa_aes_256_sha in firefox.  I know this is not a solution but it helps me because i dont have idea of how the previous IT configure the router.. it may help you too.. 

After accessing the routers web interface I try to browse the WAN1 IP address on Google Chrome the luckily i can also access the routers web interface.. 

After resetting the router I still cannot browse the default IP of the router in Google Chrome still give this error ERR_SSL_WEAK_EPHEMERAL_DH_KEY even I try not to connect the ISP and the rest of the network so the router alone connected to my PC. 

I just configure it on firefox.. through chaging the sha values..

I have a firmware version of v4.1.1.01-sp in of rv042 which you all noticed is older and i never tried yet to change it to a newer version because I in doubt that it may cause or result to more worse.. 

Questions:

1 Why can I access the WAN 1 IP address?

2 Is the problem with routers itself hardware or software.. 

3 why the switch can still have internet connection.. 

4 the routers packets send and recieve are not equal?

[michael.evenson]

Seems to be fixed in 4.2.3.07 - installed upgrade this morning and now I can use Chrome to access the RV042 web site for maintenance. Still get - proceed with caution error, but at least I can get in now with Chrome. Goodbye - FireFox *maybe).

[eyenstein]

Yep, finally it looks like this has been fixed in the final 4.2.3.07 firmware release. Now we're just back to the nuisance "connection is not private" error. Although I believe this firmware is actually open source, perhaps some adventurous volunteer could fix that remaining error too...

[celso.gomes420]

It's now working with Safari and Firefox on MacBook OSX 10.10.5 Yosemite!!