Understanding Vulnerability Scans for Sockets

Network vulnerability scanners, such as Nessus, can report findings on the Cato Socket that appear to indicate security vulnerabilities. In many cases, these findings are false positives or generic best-practice recommendations that do not represent exploitable issues on the Socket.

This article explains common scan results reported for the Cato Socket and clarifies why these findings do not pose a security risk when the Socket is deployed with supported versions and default protections.

Open TCP Ports on the Socket

Vulnerability scanners often flag open ports as potential exposure. Socket intentionally exposes only the following TCP ports:

TCP 22 – Used for SSH access
TCP 443 – Used for HTTPS access to the Socket WebUI

No additional TCP ports are open on the Socket.

This behavior is by design and required for secure management and operation of the Socket.

Socket WebUI

Some scanners report Cross-Site Scripting (XSS) issues against the Socket WebUI.

These issues are resolved in Socket version 18 and higher

OpenSSH CVE Findings

Vulnerability scanners frequently report OpenSSH-related CVEs based on banner detection or generic version matching.

Verify the Reported OpenSSH Version

Before evaluating OpenSSH-related findings:

Verify the OpenSSH version reported by the scanner
Confirm the Socket version in use

Socket version 19 uses OpenSSH 9.3p1. In many cases, scanners flag vulnerabilities that apply to older OpenSSH versions and are not relevant to this release.

CVE-2023-38408

This CVE is not relevant to the Cato Socket

The Socket does not use the vulnerable OpenSSH feature required to exploit this issue

CVE-2002-20001

These CVEs describe SSH brute force attack vectors
The Socket includes built-in SSH brute force attack protection
This protection prevents exploitation of these CVEs and many similar attack techniques

Missing HTTP Security Headers

Scanners may report missing HTTP security headers as vulnerabilities.

These findings are general security recommendations, not Socket vulnerabilities.

Strict-Transport-Security

The Socket WebUI is an internal management interface
It does not use a public FQDN
The Strict-Transport-Security header is not applicable in this context

X-Content-Type-Options

This header is primarily relevant for web applications that support file upload functionality
The Socket WebUI does not include file upload functionality
As a result, this finding does not indicate a security issue

Autocomplete Enabled for Password Fields

Some scanners report that the autocomplete attribute is enabled for password fields.

The finding does not represent an exploitable vulnerability in the Socket
Scanners are looking for the autocomplete=off attribute , which is not present

TLS Ciphers

Sockets advertise these TLS ciphers that are known vulnerabilities.

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

The CBC-related concerns affect TLS 1.0/SSL 3.0 and earlier versions. Sockets use TLS 1.2, which mitigates these issues, and AES-GCM is supported and preferred