Loading...
Loading...
A Tenable vulnerability scan flags WatchGuard Wi-Fi access points with the finding "mDNS Detection (Remote Network)" on UDP port 5353. WatchGuard access points managed in WatchGuard Cloud use mDNS (multicast DNS) and DNS-SD (DNS Service Discovery) to support legitimate local network functions, including: Printer discovery Casting device discovery (for example, Chromecast) Local AP name resolution (for example, AP330.local) Because this service listens on UDP port 5353, Tenable identifies it as a potential vulnerability. An attacker already present on the internal network could use mDNS to discover information about hosts on a separate subnet through the device. WatchGuard has assessed this as a low-risk potential vulnerability.
WatchGuard recommends the following mitigations to reduce exposure: Option 1 — VLAN Separation (Recommended) Segment your wired and wireless clients into separate VLANs. This limits the ability of an attacker on the wired LAN from discovering information about wireless hosts, and vice versa. For more information, go to: Access Points and VLANs Configure Firebox VLANs Option 2 — Block mDNS at the Firewall Configure your Firebox to block UDP port 5353 on network segments where mDNS discovery is not required. Note: Blocking port 5353 will prevent clients on those segments from discovering printers, casting devices, and other mDNS-advertised services. Confirm this is acceptable for your environment before applying this policy.
Click on a version to see all relevant bugs
WatchGuard Technologies Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.