Detections
Analytics

1.6 Support Web Access Security - b) ssl-context field

Information

Provide secure HTTPS webpage access between the local device and users, and a secure transmission channel for users' Web management devices. Avoid interception of intermediate data. If the login page needs to be displayed in the web, the login username and password can be used to access the page, meeting the scanning requirements of security tools such as nessus, webinspect, and AWE.

 NOTE: web secure-server and ssl-context are configured.

Solution

1. use HTTPS instead of HTTP, SSL must bound PKI profile, the bounded PKI profile needs to import a legal and valid CA certificate.
 2. TLS(SSL) version is recommended to be equal or greater than TLS v1.2.
 3. TLS algorithm does not contain insecure algorithms, which include: CBC, SHA1, MD5.

See Also

https://support.zte.com.cn/support/doccenter/DocumentProductHandBookDetail.aspx?sid=102&id=30768582&type=docfeedback

Item Details

Plugin: ZTE_ROSNG

Control ID: 3371ee4e47cb5ed67897a75cbb94113b007a960a0038c5710ebe642ccbe8d411