SSH/SNMP

l   Access to the device database via TCP is prohibited.

l   SSH is disabled in scenarios such as local forwarding, proxy forwarding, reverse tunneling, gateway port (NAT traversal), and SFTP transfer.

l   If login to the device using the root account fails, the account field in the system log displays unknown instead of root.

l   After SNMP is enabled, the default protocol version is set to v3.

l   NETCONF connections to the device using the root account are prohibited.

1622553

An attacker uses the root account to probe the device.

1625028

When an IP address maps to two MAC addresses, security logs and other services may return an incorrect MAC address during IP-based MAC lookup.

1622663

Unknown URLs cannot match traffic control policies, resulting in ineffective rate limiting.

1639620

Link detection repeatedly stops and restarts, leading to increased CPU utilization, higher network latency, and network performance degradation.

1639181

In web authentication scenarios, when the number of online users exceeds approximately 1500, anomalies may occur on the 40G interface link, and the forwarding function may fail to recover.

1634089

Due to timestamp discrepancies between the management plane and the forwarding plane, the traffic analysis function behaves abnormally, which can lead to user disconnections.

1642642

When a user with a GBK-encoded username goes online through WiFiDog authentication, the user list and logs are displayed incorrectly.

1642065

Improper handling of DNS resolution packets leads to an out-of-bounds memory access.

1642057

When a port mapping rule is configured on the firewall, the automatically generated security policy uses any as both the source address object and destination address object.

1645786

When the number of SAs reaches the limit, an overflow occurs, causing SA creation failures and abnormal traffic forwarding.

1645782

When IPsec VPN is configured on a device running NGFW_NTOS 1.0 R6, custom IPsec tunnels become unavailable after a direct or indirect upgrade to NGFW_NTOS 1.0 R12 or later.

1645622

When an aggregate interface is created and assigned the same IPv4 address as one of its member interfaces, the address configured on the aggregate interface does not take effect.