# stig_rules

vuln_id: V-216684
rule_id: SV-216684r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router providing connectivity to the Network Operations Center (NOC) must be configured to forward all in-band management traffic via an IPsec tunnel.

description:
  <VulnDiscussion>When the production network is managed in-band, the management network could be housed at a NOC that is located remotely at single or multiple interconnected sites. NOC interconnectivity, as well as connectivity between the NOC and the managed network, must be enabled using IPsec tunnels to provide the separation and integrity of the managed traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Ensure that all traffic from the managed network to the management network is secured via IPsec tunnel as shown in the configuration examples below.

  Step 1: Configure the ACL for the management network as the destination. This ACL will be defined in the crypto as the interesting traffic to be forwarded into the IPsec tunnel.

  R4(config)#ip access-list extended MGMT_TRAFFIC_ACL
  R4(config-ext-nacl)#permit ip 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255
  R4(config-ext-nacl)#exit

  Step 2: Create an ISAKMP policy for Phase 1 negotiations.

  R4(config)#crypto isakmp policy 10
  R4(config-isakmp)#hash sha256
  R4(config-isakmp)#authentication pre-share
  R4(config-isakmp)#exit

  Step 3: Specify the pre-shared key and the remote peer address.

  R4(config)#crypto isakmp key 0 xxxxxx address 10.1.12.1

  Note: Digital certificates can be utilized as an alternative.
   
  Step 4: Create the Phase 2 policy for the data encryption.

  R4(config)#crypto ipsec transform-set TRANS_SET ah-sha256-hmac esp-aes
  R4(cfg-crypto-trans)#mode tunnel
  R4(cfg-crypto-trans)#exit

  Step 5: Create the crypto map.

  R4(config)#crypto map IPSEC_MGMT_MAP 10 ipsec-isakmp
  R4(config-crypto-map)#set peer 10.1.12.1
  R4(config-crypto-map)#match address MGMT_TRAFFIC_ACL
  R4(config-crypto-map)#set transform-set TRANS_SET
  R4(config-crypto-map)#end

  Step 6: Apply the crypto map to the external interface. 

  R4(config)#int g0/2
  R4(config-if)#crypto map IPSEC_MGMT_MAP

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Verify that all traffic from the managed network to the management network or NOC and vice-versa is secured via IPsec tunnel.

  Step 1: Note the crypto map applied to the external interface.

   interface GigabitEthernet0/2
   description link to DISN
   ip address x.1.24.4 255.255.255.0
   crypto map IPSEC_MGMT_MAP

  Step 2: Review the ISAKMP policy for Phase 1 negotiations and Phase 2 policy for data encryption.

  crypto isakmp policy 10
   authentication pre-share
   hash sha256
   crypto isakmp key xxxxxx address x.1.12.1
  !
  !
  crypto ipsec transform-set TRANS_SET ah-sha256-hmac esp-aes 

  Step 3: Review the crypto map that was bound to the external interface and note the ACL defined that identifies the interesting traffic for the IPsec tunnel.

  crypto map IPSEC_MGMT_MAP 10 ipsec-isakmp
   set peer x.1.12.1
   set transform-set TRANS_SET
   match address MGMT_TRAFFIC_ACL

  Step 4: Review the ACL defined in the crypto map and verify that the destination is the management network.

  ip access-list extended MGMT_TRAFFIC_ACL
   permit ip 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255

  Note: The management network is this example is 10.22.2.0/24

  If the management traffic is not secured via IPsec tunnel, this is a finding.


vuln_id: V-216687
rule_id: SV-216687r877982_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

description:
  <VulnDiscussion>Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to reject inbound route advertisements for any Bogon prefixes.

  Step 1: Configure a prefix list containing the current Bogon prefixes as shown below:

  R1(config)#ip prefix-list PREFIX_FILTER deny 0.0.0.0/8 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 10.0.0.0/8 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 100.64.0.0/10 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 127.0.0.0/8 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 169.254.0.0/16 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 172.16.0.0/12 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 192.0.2.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 192.88.99.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 192.168.0.0/16 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 198.18.0.0/15 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 198.51.100.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 203.0.113.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 224.0.0.0/4 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 240.0.0.0/4 le 32
  R1(config)#ip prefix-list PREFIX_FILTER deny 240.0.0.0/4 le 32
  R1(config)#ip prefix-list PREFIX_FILTER permit 0.0.0.0/0 ge 8

  Step 2: Apply the prefix list filter inbound to each external BGP neighbor as shown in the example:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 prefix-list PREFIX_FILTER in
  R1(config-router)#neighbor x.2.1.7 prefix-list PREFIX_FILTER in

  Route Map Alternative: 

  Step 1: Configure the route map referencing the configured prefix list above.

  R1(config)#route-map FILTER_PREFIX_MAP 10
  R1(config-route-map)#match ip address prefix-list PREFIX_FILTER
  R1(config-route-map)#exit

  Step 2: Apply the route-map inbound to each external BGP neighbor as shown in the example:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 route-map FILTER_PREFIX_MAP in
  R1(config-router)#neighbor x.2.1.7 route-map FILTER_PREFIX_MAP in 
  R1(config-router)#end

check_text:
  This check is Not Applicable for JRSS internal EBGP use.

  Review the router configuration to verify that it will reject BGP routes for any Bogon prefixes.

  Step 1: Verify a prefix list has been configured containing the current Bogon prefixes as shown in the example below:

  ip prefix-list PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32
  ip prefix-list PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32
  ip prefix-list PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32
  ip prefix-list PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32
  ip prefix-list PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32
  ip prefix-list PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32
  ip prefix-list PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32
  ip prefix-list PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32
  ip prefix-list PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32
  ip prefix-list PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32
  ip prefix-list PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32
  ip prefix-list PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32
  ip prefix-list PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32
  ip prefix-list PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32
  ip prefix-list PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8

  Step 2: Verify that the prefix list has been applied to all external BGP peers as shown in the example below:

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 prefix-list PREFIX_FILTER in
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 prefix-list PREFIX_FILTER in

  Route Map Alternative: 

  Verify that the route map applied to the external neighbors references the configured Bogon prefix list shown above.

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 route-map FILTER_PREFIX_MAP
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 route-map FILTER_PREFIX_MAP
  …
  route-map FILTER_PREFIX_MAP permit 10
   match ip address prefix-list PREFIX_FILTER

  If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.


vuln_id: V-216688
rule_id: SV-216688r531086_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

description:
  <VulnDiscussion>Accepting route advertisements belonging to the local AS can result in traffic looping or being black-holed, or at a minimum, using a non-optimized path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to reject inbound route advertisements for any prefixes belonging to the local AS.

  Step 1: Add to the prefix filter list those prefixes belonging to the local autonomous system.

  R1(config)#ip prefix-list PREFIX_FILTER seq 74 deny x.13.1.0/24 le 32

  Step 2: If not already completed to be compliant with previous requirement, apply the prefix list filter inbound to each external BGP neighbor as shown in the example.

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 prefix-list PREFIX_FILTER in
  R1(config-router)#neighbor x.2.1.7 prefix-list PREFIX_FILTER in

check_text:
  Review the router configuration to verify that it will reject routes belonging to the local AS.

  Step 1: Verify a prefix list has been configured containing prefixes belonging to the local AS. In the example below, x.13.1.0/24 is the global address space allocated to the local AS.

  ip prefix-list PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32
  …
  …
  …
  ip prefix-list PREFIX_FILTER seq 74 deny x.13.1.0/24 le 32
  ip prefix-list PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8

  Step 2: Verify that the prefix list has been applied to all external BGP peers as shown in the example below:

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 prefix-list PREFIX_FILTER in
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 prefix-list PREFIX_FILTER in

  If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.


vuln_id: V-216689
rule_id: SV-216689r917428_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

description:
  <VulnDiscussion>As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multi-homed customer with BGP speaking routers connected to the Internet or other external networks could be breached and used to launch a prefix de-aggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer.

  Step 1: Configure a prefix list for each customer containing prefixes belonging to each.

  R1(config)#ip prefix-list PREFIX_FILTER_CUST1 permit x.13.1.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER_CUST1 deny 0.0.0.0/0 ge 8
  R1(config)#ip prefix-list PREFIX_FILTER_CUST2 permit x.13.2.0/24 le 32
  R1(config)#ip prefix-list PREFIX_FILTER_CUST2 deny 0.0.0.0/0 ge 8

  Step 2: Apply the prefix list filter inbound to each CE neighbor as shown in the example.

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.12.4.14 prefix-list FILTER_PREFIXES_CUST1 in
  R1(config-router)#neighbor x.12.4.16 prefix-list FILTER_PREFIXES_CUST2 in

check_text:
  Review the router configuration to verify that there are ACLs defined to only accept routes for prefixes that belong to specific customers. 

  Step 1: Verify prefix list has been configured for each customer containing prefixes belonging to each customer as shown in the example below:

  ip prefix-list PREFIX_FILTER_CUST1 seq 5 permit x.13.1.0/24 le 32
  ip prefix-list PREFIX_FILTER_CUST1 seq 10 deny 0.0.0.0/0 ge 8
  ip prefix-list PREFIX_FILTER_CUST2 seq 5 permit x.13.2.0/24 le 32
  ip prefix-list PREFIX_FILTER_CUST2 seq 10 deny 0.0.0.0/0 ge 8

  Step 2: Verify that the prefix lists has been applied to all to the applicable CE peers as shown in the example below:

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.12.4.14 remote-as 64514
   neighbor x.12.4.14 prefix-list FILTER_PREFIXES_CUST1 in
   neighbor x.12.4.16 remote-as 64516
   neighbor x.12.4.16 prefix-list FILTER_PREFIXES_CUST2 in

  Note: Routes to PE-CE links within a VPN are needed for troubleshooting end-to-end connectivity across the MPLS/IP backbone. Hence, these prefixes are an exception to this requirement.

  Note: This check is NA for JRSS systems.

  If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.


vuln_id: V-216690
rule_id: SV-216690r917430_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

description:
  <VulnDiscussion>Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the GIG IP core could redistribute Interior Gateway Protocol (IGP) routes into BGP, thereby leaking internal routes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below:

  R1(config)#ip prefix-list CE_PREFIX_ADVERTISEMENTS permit x.13.1.0/24 le 32
  R1(config)#ip prefix-list CE_PREFIX_ADVERTISEMENTS permit x.13.2.0/24 le 32
  R1(config)#ip prefix-list CE_PREFIX_ADVERTISEMENTS permit x.13.3.0/24 le 32
  R1(config)#ip prefix-list CE_PREFIX_ADVERTISEMENTS permit x.13.4.0/24 le 32
  …
  …
  …
  R1(config)#ip prefix-list CE_PREFIX_ADVERTISEMENTS deny 0.0.0.0/0 ge 8

  Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example.

  R1(config)#router bgp 64512
  R1(config-router)#neighbor x.12.4.14 prefix-list CE_PREFIX_ADVERTISEMENTS out
  R1(config-router)#neighbor x.12.4.16 prefix-list CE_PREFIX_ADVERTISEMENTS out

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Verify that a prefix list has been configured containing prefixes belonging to customers as well as the local AS as shown in the example below.

  ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 5 permit x.13.1.0/24 le 32
  ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 10 permit x.13.2.0/24 le 32
  ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 15 permit x.13.3.0/24 le 32
  ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 20 permit x.13.4.0/24 le 32
  …
  …
  …
  ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 80 deny 0.0.0.0/0 ge 8

  Step 2: Verify that the prefix lists has been applied to all CE peers as shown in the example below.

  router bgp 64512
   no synchronization
   bgp log-neighbor-changes
   neighbor x.12.4.14 remote-as 64514
   neighbor x.12.4.14 prefix-list CE_PREFIX_ADVERTISEMENTS out
   neighbor x.12.4.16 remote-as 64516
   neighbor x.12.4.16 prefix-list CE_PREFIX_ADVERTISEMENTS out

  Note: This check is NA for JRSS systems.

  If the router is not configured to reject outbound route advertisements that do not belong to any customers or the local AS, this is a finding.


vuln_id: V-216691
rule_id: SV-216691r929058_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

description:
  <VulnDiscussion>Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below:

  R1(config)#ip prefix-list FILTER_CORE_PREFIXES deny x.1.1.0/24 le 32
  R1(config)#ip prefix-list FILTER _CORE_PREFIXES deny x.1.2.0/24 le 32
  R1(config)#ip prefix-list FILTER _CORE_PREFIXES permit 0.0.0.0/0 ge 8

  Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example.

  router bgp xx
   address-family ipv4
    neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out

check_text:
  Step 1: Verify that a prefix list has been configured containing prefixes belonging to the IP core.

  ip prefix-list FILTER_CORE_PREFIXES seq 5 deny x.1.1.0/24 le 32
  ip prefix-list FILTER _CORE_PREFIXES seq 10 deny x.1.2.0/24 le 32
  ip prefix-list FILTER _CORE_PREFIXES seq 15 permit 0.0.0.0/0 ge 8

  Step 2: Verify that the prefix lists has been applied to all external BGP peers as shown in the example below:

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.4.12 remote-as yy
   address-family ipv4 
    neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out

  If the router is not configured to reject outbound route advertisements for prefixes belonging to the IP core, this is a finding.


vuln_id: V-216692
rule_id: SV-216692r945854_rule
severity: CAT III
cci: CCI-000032
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

description:
  <VulnDiscussion>Verifying the path a route has traversed will ensure the IP core is not used as a transit network for unauthorized or possibly even internet traffic. All autonomous system boundary routers (ASBRs) must ensure updates received from eBGP peers list their AS number as the first AS in the AS_PATH attribute.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

  R1(config)#router bgp xx
  R1(config-router)#bgp enforce-first-as

check_text:
  Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

  By default, Cisco IOS enforces the first AS in the AS_PATH attribute for all route advertisements. Review the router configuration to verify that the command no bgp enforce-first-as is not configured.

  router bgp xx
   no synchronization
   no bgp enforce-first-as

  If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.


vuln_id: V-216693
rule_id: SV-216693r945855_rule
severity: CAT III
cci: CCI-000032
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

description:
  <VulnDiscussion>Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that do not belong to that customer.

  Step 1: Configure the as-path ACL as shown in the example below:

  R1(config)#ip as-path access-list 10 permit ^yy$
  R1(config)#ip as-path access-list 10 deny .*

  Step 2: Apply the as-path filter inbound as shown in the example below:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.4.12 filter-list 10 in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

  Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route. The configuration should look similar to the following:

  ip as-path access-list 10 permit ^yy$
  ip as-path access-list 10 deny .*

  Note: the characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted.

  Step 2: Verify that the as-path access-list is referenced by the filter-list inbound for the appropriate BGP neighbors as shown in the example below:

  router bgp xx
  neighbor x.1.4.12 remote-as yy
  neighbor x.1.4.12 filter-list 10 in

  If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.


vuln_id: V-216694
rule_id: SV-216694r855824_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.

description:
  <VulnDiscussion>The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements.

  In 1997, misconfigured routers in the Florida Internet Exchange network (AS7007) de-aggregated every prefix in their routing table and started advertising the first /24 block of each of these prefixes as their own. Faced with this additional burden, the internal routers became overloaded and crashed repeatedly. This caused prefixes advertised by these routers to disappear from routing tables and reappear when the routers came back online. As the routers came back after crashing, they were flooded with the routing table information by their neighbors. The flood of information would again overwhelm the routers and cause them to crash. This process of route flapping served to destabilize not only the surrounding network but also the entire Internet. Routers trying to reach those addresses would choose the smaller, more specific /24 blocks first. This caused backbone networks throughout North America and Europe to crash.

  Maximum prefix limits on peer connections combined with aggressive prefix-size filtering of customers' reachability advertisements will effectively mitigate the de-aggregation risk. BGP maximum prefix must be used on all eBGP routers to limit the number of prefixes that it should receive from a particular neighbor, whether customer or peering AS. Consider each neighbor and how many routes they should be advertising and set a threshold slightly higher than the number expected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks as shown in the example below:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 maximum-prefix nnnnnnn
  R1(config-router)#neighbor x.2.1.7 maximum-prefix nnnnnnn

check_text:
  Review the router configuration to verify that the number of received prefixes from each eBGP neighbor is controlled.

  router bgp xx
  neighbor x.1.1.9 remote-as yy
  neighbor x.1.1.9 maximum-prefix nnnnnnn
  neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 maximum-prefix nnnnnnn

  If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix de-aggregation attacks, this is a finding.


vuln_id: V-216695
rule_id: SV-216695r855825_rule
severity: CAT III
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer.

description:
  <VulnDiscussion>The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer.

  Step 1: Configure a prefix list to reject any prefix that is longer than /24.

  R1(config)#ip prefix-list FILTER_PREFIX_LENGTH permit 0.0.0.0/0 ge 8 le 24
  R1(config)#ip prefix-list FILTER_PREFIX_LENGTH deny  0.0.0.0/0 le 32


  Step 2: Apply the prefix list to all eBGP peers as shown in the example below.

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 prefix-list FILTER_PREFIX_LENGTH in
  R1(config-router)#neighbor x.2.1.7 prefix-list FILTER_PREFIX_LENGTH in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to determine if it is compliant with this requirement.

  Step 1: Verify that a route filter has been configured to reject prefixes longer than /24, or the least significant prefixes issued to the customers as shown in the example below:

  ip prefix-list FILTER_PREFIX_LENGTH seq 5 permit 0.0.0.0/0 ge 8 le 24
  ip prefix-list FILTER_PREFIX_LENGTH seq 10 deny 0.0.0.0/0 le 32

  Step 2: Verify that prefix filtering has been applied to each eBGP peer as shown in the example:

  router bgp xx
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 prefix-list FILTER_PREFIX_LENGTH in
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 prefix-list FILTER_PREFIX_LENGTH in


  If the router is not configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer, this is a finding.


vuln_id: V-216696
rule_id: SV-216696r991893_rule
severity: CAT III
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to use its loopback address as the source address for iBGP peering sessions.

description:
  <VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of the BGP routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.

  When the loopback address is used as the source for eBGP peering, the BGP session will be harder to hijack since the source address to be used is not known globally, making it more difficult for a hacker to spoof an eBGP neighbor. By using traceroute, a hacker can easily determine the addresses for an eBGP speaker when the IP address of an external interface is used as the source address. The routers within the iBGP domain should also use loopback addresses as the source address when establishing BGP sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to use its loopback address as the source address for all iBGP peering.

  R1(config)#router bgp xx
  R1(config-router)#neighbor 10.1.1.1 update-source Loopback0

check_text:
  Step 1: Review the router configuration to verify that a loopback address has been configured.

  interface Loopback0
   ip address 10.1.1.1 255.255.255.255

  Step 2: Verify that the loopback interface is used as the source address for all iBGP sessions.

  router bgp xx
   no synchronization
   no bgp enforce-first-as
   bgp log-neighbor-changes
   redistribute static
   neighbor 10.1.1.1 remote-as xx
   neighbor 10.1.1.1 password xxxxxxxx
   neighbor 10.1.1.1 update-source Loopback0
   
  If the router does not use its loopback address as the source address for all iBGP sessions, this is a finding.


vuln_id: V-216697
rule_id: SV-216697r991894_rule
severity: CAT III
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco MPLS router must be configured to use its loopback address as the source address for LDP peering sessions.

description:
  <VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of backbone routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of from a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to use their loopback address as the source address for LDP peering sessions. As noted in the check content, the default behavior is to use its loopback address. 

  R4(config)#mpls ldp router-id lo0

check_text:
  Review the router configuration to determine if it is compliant with this requirement.

  Verify that a loopback address has been configured as shown in the following example:

  interface Loopback0
   ip address 10.1.1.1 255.255.255.255

  By default, routers will use its loopback address for LDP peering. If an address has not be configured on the loopback interface, it will use its physical interface connecting to the LDP peer. If the router-id command is specified that overrides this default behavior, verify that it is a loopback interface as shown in the example below:

  mpls ldp router-id Loopback0

  If the router is not configured to use its loopback address for LDP peering, this is a finding.


vuln_id: V-216698
rule_id: SV-216698r531086_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco MPLS router must be configured to synchronize Interior Gateway Protocol (IGP) and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

description:
  <VulnDiscussion>Packet loss can occur when an IGP adjacency is established and the router begins forwarding packets using the new adjacency before the LDP label exchange completes between the peers on that link. Packet loss can also occur if an LDP session closes and the router continues to forward traffic using the link associated with the LDP peer rather than an alternate pathway with a fully synchronized LDP session. The MPLS LDP-IGP Synchronization feature provides a means to synchronize LDP with OSPF or IS-IS to minimize MPLS packet loss. When an IGP adjacency is established on a link but LDP-IGP synchronization is not yet achieved or is lost, the IGP will advertise the max-metric on that link.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

  OSPF Example:

  R2(config)#router ospf 1
  R2(config-router)#mpls ldp sync

  IS-IS Example:

  R5(config)#router isis
  R5(config-router)#mpls ldp sync

check_text:
  Review the router OSPF or IS-IS configuration and verify that LDP will synchronize with the link-state routing protocol as shown in the example below:

  OSPF Example:

  router ospf 1
   mpls ldp sync

  IS-IS Example:

  router isis
   mpls ldp sync
   net 49.0001.1234.1600.5531.00

  If the router is not configured to synchronize IGP and LDP, this is a finding.


vuln_id: V-216699
rule_id: SV-216699r531086_rule
severity: CAT III
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The MPLS router with RSVP-TE enabled must be configured with message pacing to adjust maximum burst and maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core routers.

description:
  <VulnDiscussion>RSVP-TE can be used to perform constraint-based routing when building LSP tunnels within the network core that will support QoS and traffic engineering requirements. RSVP-TE is also used to enable MPLS Fast Reroute, a network restoration mechanism that will reroute traffic onto a backup LSP in case of a node or link failure along the primary path. When there is a disruption in the MPLS core, such as a link flap or router reboot, the result is a significant amount of RSVP signaling, such as "PathErr" and "ResvErr" messages that need to be sent for every LSP using that link.

  When RSVP messages are sent out, they are sent either hop by hop or with the router alert bit set in the IP header. This means that every router along the path must examine the packet to determine if additional processing is required for these RSVP messages. If there is enough signaling traffic in the network, it is possible for an interface to receive more packets for its input queue than it can hold, resulting in dropped RSVP messages and hence slower RSVP convergence. Increasing the size of the interface input queue can help prevent dropping packets; however, there is still the risk of having a burst of signaling traffic that can fill the queue. Solutions to mitigate this risk are RSVP message pacing or refresh reduction to control the rate at which RSVP messages are sent. RSVP refresh reduction includes the following features: RSVP message bundling, RSVP Message ID to reduce message processing overhead, reliable delivery of RSVP messages using Message ID,  and summary refresh to reduce the amount of information transmitted every refresh interval.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to rate limit RSVP messages per interface as shown in the example.

  R2(config)#ip rsvp signalling rate-limit burst 9  maxsize 2100 period 30 limit 50

check_text:
  Review the router configuration to determine RSVP messages are rate limited.

  Step 1: Determine if MPLS TE is enabled globally and at least one interface as shown in the example below: 

  mpls traffic-eng tunnels
  …
  …
  …
  interface GigabitEthernet0/2
   ip address x.x.x.x 255.255.255.0
   mpls traffic-eng tunnels
   mpls ip

  Step 2: If MPLS TE is enabled, verify that message pacing is enabled.

  ip rsvp signalling rate-limit period 30 burst 9 maxsize 2100 limit 50

  Note: The command "ip rsvp msg-pacing" has been deprecated by the command "ip rsvp signalling rate-limit" 

  If the router with RSVP-TE enabled does not rate limit RSVP messages based on the link speed and input queue size of adjacent core routers, this is a finding.


vuln_id: V-216700
rule_id: SV-216700r531086_rule
severity: CAT II
title: The Cisco MPLS router must be configured to have TTL Propagation disabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The head end of the label-switched path (LSP), the label edge router (LER) will decrement the IP packet's time-to-live (TTL) value by one and then copy the value to the MPLS TTL field. At each label-switched router (LSR) hop, the MPLS TTL value is decremented by one. The MPLS router that pops the label (either the penultimate LSR or the egress LER) will copy the packet's MPLS TTL value to the IP TTL field and decrement it by one.

  This TTL propagation is the default behavior. Because the MPLS TTL is propagated from the IP TTL, a traceroute will list every hop in the path, be it routed or label switched, thereby exposing core nodes. With TTL propagation disabled, LER decrements the IP packet's TTL value by one and then places a value of 255 in the packet's MPLS TTL field, which is then decremented by one as the packet passes through each LSR in the MPLS core. Because the MPLS TTL never drops to zero, none of the LSP hops triggers an ICMP TTL exceeded message, and consequently, these hops are not recorded in a traceroute. Hence, nodes within the MPLS core cannot be discovered by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the MPLS router to disable TTL propagation as shown in the example below:

  R5(config)#no mpls ip propagate-ttl

check_text:
  Review the router configuration to verify that TTL propagation is disabled as shown in the example below:

  no mpls ip propagate-ttl

  If the MPLS router is not configured to disable TTL propagation, this is a finding.


vuln_id: V-216701
rule_id: SV-216701r991895_rule
severity: CAT I
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.

description:
  <VulnDiscussion>The primary security model for an MPLS L3VPN infrastructure is traffic separation. The service provider must guarantee the customer that traffic from one VPN does not leak into another VPN or into the core, and that core traffic must not leak into any VPN. Hence, it is imperative that each CE-facing interface can only be associated to one VRF—that alone is the fundamental framework for traffic separation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the PE router to have each VRF bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.

check_text:
  Step 1: Review the design plan for deploying MPLS/L3VPN.

  Step 2: Review all CE-facing interfaces and verify that the proper VRF is defined via the "ip vrf forwarding" command. In the example below, COI1 is bound to interface GigabitEthernet0/1, while COI2 is bound to GigabitEthernet0/2.

  interface GigabitEthernet0/1
   description link to COI1
   ip vrf forwarding COI1
   ip address x.1.0.1 255.255.255.0
  !
  interface GigabitEthernet0/2
   description link to COI2
   ip vrf forwarding COI2
   ip address x.2.0.2 255.255.255.0

  If any VRFs are not bound to the appropriate physical or logical interface, this is a finding.


vuln_id: V-216702
rule_id: SV-216702r991897_rule
severity: CAT I
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).

description:
  <VulnDiscussion>The primary security model for an MPLS L3VPN as well as a VRF-lite infrastructure is traffic separation. Each interface can only be associated to one VRF, which is the fundamental framework for traffic separation. Forwarding decisions are made based on the routing table belonging to the VRF. Control of what routes are imported into or exported from a VRF is based on the RT. It is critical that traffic does not leak from one COI tenant or L3VPN to another; hence, it is imperative that the correct RT is configured for each VRF.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to have each VRF instance defined with the correct RT.

  R5(config)#ip vrf CUST1
  R5(config-vrf)#route-target import 13:13
  R5(config-vrf)#route-target export 13:13
  R5(config-vrf)#end

check_text:
  Review the design plan for MPLS/L3VPN to determine what RTs have been assigned for each VRF. Review the router configuration and verify that the correct RT is configured for each VRF. In the example below, route target 13:13 has been configured for customer 1.

  ip vrf CUST1
   rd 13:13
   route-target export 13:13
   route-target import 13:13

  If there are VRFs configured with the wrong RT, this is a finding.


vuln_id: V-216703
rule_id: SV-216703r991899_rule
severity: CAT II
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to have each VRF with the appropriate Route Distinguisher (RD).

description:
  <VulnDiscussion>An RD provides uniqueness to the customer address spaces within the MPLS L3VPN infrastructure. The concept of the VPN-IPv4 and VPN-IPv6 address families consists of the RD prepended before the IP address. Hence, if the same IP prefix is used in several different L3VPNs, it is possible for BGP to carry several completely different routes for that prefix, one for each VPN.

  Since VPN-IPv4 addresses and IPv4 addresses are different address families, BGP never treats them as comparable addresses. The purpose of the RD is to create distinct routes for common IPv4 address prefixes. On any given PE router, a single RD can define a VRF in which the entire address space may be used independently, regardless of the makeup of other VPN address spaces. Hence, it is imperative that a unique RD is assigned to each L3VPN and that the proper RD is configured for each VRF.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the correct RD for each VRF.

  R5(config)#ip vrf CUST1
  R5(config-vrf)#rd 13:13
  R5(config-vrf)#end

check_text:
  Review the design plan for MPLS/L3VPN to determine what RD have been assigned for each VRF. Review the router configuration and verify that the correct RD is configured for each VRF. In the example below, route distinguisher 13:13 has been configured for customer 1.

  ip vrf CUST1
   rd 13:13

  Note: This requirement is only applicable for MPLS L3VPN implementations.

  If the wrong RD has been configured for any VRF, this is a finding.


vuln_id: V-216704
rule_id: SV-216704r864163_rule
severity: CAT II
cci: CCI-001958
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router providing MPLS Layer 2 Virtual Private Network (L2VPN) services must be configured to authenticate targeted Label Distribution Protocol (LDP) sessions used to exchange virtual circuit (VC) information using a FIPS-approved message authentication code algorithm.

description:
  <VulnDiscussion>LDP provides the signaling required for setting up and tearing down pseudowires (virtual circuits used to transport Layer 2 frames) across an MPLS IP core network. Using a targeted LDP session, each PE router advertises a virtual circuit label mapping that is used as part of the label stack imposed on the frames by the ingress PE router during packet forwarding. Authentication provides protection against spoofed TCP segments that can be introduced into the LDP sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The severity level can be downgraded to a category 3 if the router is configured to authenticate targeted LDP sessions using MD5 as shown in the example below.

  R5(config)#mpls ldp neighbor 10.1.1.2 password xxxxxxxx

check_text:
  The Cisco router is not compliant with this requirement; hence, it is a finding. However, the severity level can be downgraded to a category 3 if the router is configured to authenticate targeted LDP sessions using MD5 as shown in the configuration example below.

  mpls ldp neighbor 10.1.1.2 password xxxxxxx
  mpls label protocol ldp

  If the router is not configured to authenticate targeted LDP sessions using MD5, the finding will remain as a CAT II.


vuln_id: V-216705
rule_id: SV-216705r991900_rule
severity: CAT I
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router providing MPLS Virtual Private Wire Service (VPWS) must be configured to have the appropriate virtual circuit identification (VC ID) for each attachment circuit.

description:
  <VulnDiscussion>VPWS is an L2VPN technology that provides a virtual circuit between two PE routers to forward Layer 2 frames between two customer-edge routers or switches through an MPLS-enabled IP core. The ingress PE router (virtual circuit head-end) encapsulates Ethernet frames inside MPLS packets using label stacking and forwards them across the MPLS network to the egress PE router (virtual circuit tail-end). During a virtual circuit setup, the PE routers exchange VC label bindings for the specified VC ID. The VC ID specifies a pseudowire associated with an ingress and egress PE router and the customer-facing attachment circuits. 

  To guarantee that all frames are forwarded onto the correct pseudowire and to the correct customer and attachment circuits, it is imperative that the correct VC ID is configured for each attachment circuit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Assign globally unique VC IDs for each virtual circuit and configure the attachment circuits with the appropriate VC ID. 

  R5(config)#int g0/1
  R5(config-if)#xconnect x.2.2.12 55 encapsulation mpls

check_text:
  Verify that the correct and unique VCID has been configured for the appropriate attachment circuit. In the example below, GigabitEthernet0/1 is the CE-facing interface that is configured for VPWS with the VCID of 55.

  interface GigabitEthernet0/1
   xconnect x.2.2.12 55 encapsulation mpls

  If the correct VC ID has not been configured on both routers, this is a finding.


vuln_id: V-216706
rule_id: SV-216706r531086_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.

description:
  <VulnDiscussion>VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer Layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet bridging principles. A pseudowire is a virtual bidirectional connection between two attachment circuits (virtual connections between PE and CE routers). A pseudowire contains two unidirectional label-switched paths (LSP) between two PE routers. Each MAC virtual forwarding table instance (VFI) is interconnected using pseudowires provisioned for the bridge domain, thereby maintaining privacy and logical separation between each VPLS bridge domain.

  The VFI specifies the pseudowires associated with connecting PE routers and the customer-facing attachment circuits belonging to a given VLAN. Resembling a Layer 2 switch, the VFI is responsible for learning MAC addresses and providing loop-free forwarding of customer traffic to the appropriate end nodes. Each VPLS domain is identified by a globally unique VPN ID; hence, VFIs of the same VPLS domain must be configured with the same VPN ID on all participating PE routers. To guarantee traffic separation for all customer VLANs and that all packets are forwarded to the correct destination, it is imperative that the correct attachment circuits are associated with the appropriate VFI and that each VFI is associated to the unique VPN ID assigned to the customer VLAN.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Assign globally unique VPN IDs for each customer bridge domain using VPLS for carrier Ethernet services between multiple sites, and configure the attachment circuits to the appropriate VFI.

  R1(config)#l2 vfi VPLS_A manual
  R1(config-vfi)#vpn id 110
  R1(config-vfi)#neighbor 10.3.3.3 encapsulation mpls
  R1(config-vfi)#bridge-domain 100
  R1(config-vfi)#exit
  R1(config-if)#service instance 10 ethernet
  R1(config-if-srv)#encapsulation untagged 
  R1(config-if-srv)#bridge-domain 100
  R1(config-if-srv)#end

check_text:
  Review the implementation plan and the VPN IDs assigned to customer VLANs for the VPLS deployment.

  Review the PE router configuration to verify that customer attachment circuits are associated to the appropriate VFI. In the example below, the attached circuit at interface GigabitEthernet3 is associated to VPN ID 110.

  l2 vfi VPLS_A manual 
   vpn id 110
   bridge-domain 100
   neighbor 10.3.3.3 encapsulation mpls
   neighbor 10.3.3.4 encapsulation mpls
  …
  …
  …
  interface GigabitEthernet3
   no ip address
   service instance 10 ethernet
    encapsulation untagged
    bridge-domain 100

  If the attachment circuits have not been bound to VFI configured with the assigned VPN ID for each VLAN, this is a finding.


vuln_id: V-216707
rule_id: SV-216707r531086_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to enforce the split-horizon rule for all pseudowires within a Virtual Private LAN Services (VPLS) bridge domain.

description:
  <VulnDiscussion>A virtual forwarding instance (VFI) must be created on each participating PE router for each customer VLAN using VPLS for carrier Ethernet services. The VFI specifies the VPN ID of a VPLS domain, the addresses of other PE routers in the domain, and the type of tunnel signaling and encapsulation mechanism for each peer PE router. The set of VFIs formed by the interconnection of the emulated VCs is called a VPLS instance, which forms the logic bridge over the MPLS core network.

  The PE routers use the VFI with a unique VPN ID to establish a full mesh of emulated virtual circuits or pseudowires to all the other PE routers in the VPLS instance. The full-mesh configuration allows the PE router to maintain a single broadcast domain. With a full-mesh configuration, signaling and packet replication requirements for each provisioned virtual circuit on a PE can be high. To avoid the problem of a packet looping in the provider core, thereby adding more overhead, the PE devices must enforce a split-horizon principle for the emulated virtual circuits; that is, if a packet is received on an emulated virtual circuit, it is not forwarded on any other virtual circuit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Enable split horizon on all PE routers deploying VPLS in a full-mesh configuration.

  R1(config)#l2 vfi VPLS_A manual                                 
  R1(config-vfi)#neighbor 10.3.3.3 encapsulation mpls

check_text:
  Review the PE router configuration to verify that split horizon is enabled. By default, split horizon is enabled; hence, the attribute no-split-horizon should not be seen on the neighbor command as shown in the example below:

  l2 vfi VPLS_A manual 
   vpn id 110
   bridge-domain 100
   neighbor 10.3.3.3 encapsulation mpls no-split-horizon

  If split horizon is not enabled, this is a finding.

  Note: This requirement is only applicable to a mesh VPLS topology. VPLS solves the loop problem by using a split-horizon rule which states that member PE routers of a VPLS must forward VPLS traffic only to the local attachment circuits when they receive the traffic from the other PE routers. In a ring VPLS, split horizon must be disabled so that a PE router can forward a packet received from one pseudowire to another pseudowire. To prevent the consequential loop, at least one span in the ring would not have a pseudowire for any given VPLS instance.


vuln_id: V-216708
rule_id: SV-216708r531086_rule
severity: CAT II
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

description:
  <VulnDiscussion>A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure storm control for each CE-facing interface as shown in the example below:

  R1(config)#int g3
  R1(config-if)#service instance 10 ethernet 
  R1(config-if-srv)#storm-control broadcast cir 12000000
  R1(config-if-srv)#end

  Note: The acceptable range is 10000000 -1000000000 for a gigabit ethernet interface, and 100000000-10000000000 for a ten gigabit interface. Storm control is not supported on most FastEthernet interfaces.

check_text:
  Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS as shown in the example below:

  interface GigabitEthernet3
   no ip address
   service instance 10 ethernet
    encapsulation untagged
    bridge-domain 100
    storm-control broadcast cir 12000000 
   !
  !

  If storm control is not enabled at a minimum for broadcast traffic, this is a finding.


vuln_id: V-216709
rule_id: SV-216709r855827_rule
severity: CAT III
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.

description:
  <VulnDiscussion>IGMP snooping provides a way to constrain multicast traffic at Layer 2. By monitoring the IGMP membership reports sent by hosts within the bridge domain, the snooping application can set up Layer 2 multicast forwarding tables to deliver traffic only to ports with at least one interested member within the VPLS bridge, thereby significantly reducing the volume of multicast traffic that would otherwise flood an entire VPLS bridge domain. The IGMP snooping operation applies to both access circuits and pseudowires within a VPLS bridge domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VPLS bridge domain.

  R1(config)#bridge-domain 100
  R1(config-bdomain)#ip igmp snooping 
  R1(config-bdomain)#end

check_text:
  Review the router configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively for each VPLS bridge domain. The example below are the steps to verify that IGMP snooping is enabled for a VPLS bridge domain.

  Step 1: Verify that IGMP snooping is enabled globally. By default, IGMP snooping is enabled globally; hence, the following command should not be in the router configuration:  no ip igmp snooping

  Step 2: If IGMP snooping is enabled globally, it will also be enabled by default for each VPLS bridge domain. Hence, the command no ip igmp snooping should not be configured for any VPLS bridge domain as shown in the example below:

  bridge-domain 100 
   no ip igmp snooping
  !

  If the router is not configured to implement IGMP or MLD snooping for each VPLS bridge domain, this is a finding.


vuln_id: V-216710
rule_id: SV-216710r531086_rule
severity: CAT II
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.

description:
  <VulnDiscussion>VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer Layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet bridging principles. A pseudowire is a virtual bidirectional connection between two attachment circuits (virtual connections between PE and CE routers). A pseudowire contains two unidirectional label-switched paths (LSP). Each MAC forwarding table instance is interconnected using domain-specific LSPs, thereby maintaining privacy and logical separation between each VPLS domain.

  When a frame arrives on a bridge port (pseudowire or attachment circuit) and the source MAC address is unknown to the receiving PE router, the source MAC address is associated with the pseudowire or attachment circuit and the forwarding table is updated accordingly. Frames are forwarded to the appropriate pseudowire or attachment circuit according to the forwarding table entry for the destination MAC address. Ethernet frames sent to broadcast and unknown destination addresses must be flooded out to all interfaces for the bridge domain; hence, a PE router must replicate packets across both attachment circuits and pseudowires.

  A malicious attacker residing in a customer network could launch a source MAC address spoofing attack by flooding packets to a valid unicast destination, each with a different MAC source address. The PE router receiving this traffic would try to learn every new MAC address and would quickly run out of space for the VFI forwarding table. Older, valid MAC addresses would be removed from the table, and traffic sent to them would have to be flooded until the storm threshold limit is reached. Hence, it is essential that a limit is established to control the number of MAC addresses that will be learned and recorded into the forwarding table for each bridge domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure a MAC address learning limit for each VPLS bridge domain.

  R1(config-bdomain)#mac limit maximum addresses nnnn

check_text:
  Review the PE router configuration to determine if a MAC address limit has been set for each VPLS bridge domain.

  bridge-domain 100 
   mac limit maximum addresses nnnnn

  If a limit has not been configured, this is a finding.


vuln_id: V-216711
rule_id: SV-216711r531086_rule
severity: CAT I
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to block any traffic that is destined to IP core infrastructure.

description:
  <VulnDiscussion>IP/MPLS networks providing VPN and transit services must provide, at the least, the same level of protection against denial of service (DoS) attacks and intrusions as Layer 2 networks. Although the IP core network elements are hidden, security should never rely entirely on obscurity.

  IP addresses can be guessed. Core network elements must not be accessible from any external host. Protecting the core from any attack is vital for the integrity and privacy of customer traffic as well as the availability of transit services. A compromise of the IP core can result in an outage or, at a minimum, non-optimized forwarding of customer traffic. Protecting the core from an outside attack also prevents attackers from using the core to attack any customer. Hence, it is imperative that all routers at the edge deny traffic destined to any address belonging to the IP core infrastructure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure protection for the IP core to be implemented at the edges by blocking any traffic with a destination address assigned to the IP core infrastructure.

  Step 1: Configure an ingress ACL to discard and log packets destined to the IP core address space.
   
  R2(config)#ip access-list extended BLOCK_TO_CORE
  R2(config-ext-nacl)#deny ip any 10.1.x.0 0.0.255.255 log-input
  R2(config-ext-nacl)#exit

  Step 2: Apply the ACL inbound to all external or CE-facing interfaces.

  R2(config)#int R4(config)#int g0/2
  R2(config-if)#ip access-group BLOCK_TO_CORE in
  R2(config-if)#end

check_text:
  Step 1: Review the router configuration to verify that an ingress ACL is applied to all external or CE-facing interfaces. 

  interface GigabitEthernet0/2
   ip address x.1.12.2 255.255.255.252
   ip access-group BLOCK_TO_CORE in

  Step 2: Verify that the ingress ACL discards and logs packets destined to the IP core address space. 

  ip access-list extended BLOCK_TO_CORE
   deny   ip any 10.1.x.0 0.0.255.255 log-input
   permit ip any any
  !

  If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding.

  Note: Internet Control Message Protocol (ICMP) echo requests and traceroutes will be allowed to the edge from external adjacent neighbors.


vuln_id: V-216712
rule_id: SV-216712r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.

description:
  <VulnDiscussion>The uRPF feature is a defense against spoofing and denial of service (DoS) attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all provider edge routers must enable uRPF loose mode to guarantee that all packets received from a CE router contain source addresses that are in the route table.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure uRPF loose mode on all CE-facing interfaces as shown in the example below.

  R2(config)#int R4(config)#int g0/2
  R2(config-if)#ip verify unicast source reachable-via any
  R2(config-if)#end

check_text:
  Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces.

  interface GigabitEthernet0/2
   ip address x.1.12.2 255.255.255.252
   ip access-group BLOCK_TO_CORE in
   ip verify unicast source reachable-via any

  If uRPF loose mode is not enabled on all CE-facing interfaces, this is a finding.


vuln_id: V-216714
rule_id: SV-216714r917433_rule
severity: CAT III
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications.

description:
  <VulnDiscussion>Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy.

  Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure to enforce a QoS policy to provide preferred treatment for mission-critical applications.

  Step 1: Configure class-maps to match on DSCP values as shown in the configuration example below:

  R5(config-cmap)#class-map match-all C2_VOICE
  R5(config-cmap)#match ip dscp 47
  R5(config-cmap)#class-map match-all VOICE
  R5(config-cmap)#match ip dscp ef
  R5(config-cmap)#class-map match-all VIDEO
  R5(config-cmap)#match ip dscp af41
  R5(config-cmap)#class-map match-all CONTROL_PLANE
  R5(config-cmap)#match ip dscp cs6
  R5(config)#class-map match-all PREFERRED_DATA
  R5(config-cmap)#match ip dscp af33
  R5(config-cmap)#exit

  Step 2: Configure a policy map to be applied to the core-layer-facing interface that reserves the bandwidth for each traffic type as shown in the example below:

  R5(config)#policy-map QOS_POLICY
  R5(config-pmap-c)#class C2_VOICE
  R5(config-pmap-c)#priority percent 10
  R5(config-pmap-c)#class VOICE
  R5(config-pmap-c)#priority percent 15
  R5(config-pmap-c)#class VIDEO
  R5(config-pmap-c)#bandwidth percent 25
  R5(config-pmap)#class CONTROL_PLANE
  R5(config-pmap-c)#priority percent 10
  R5(config-pmap-c)#class PREFERRED_DATA
  R5(config-pmap-c)#bandwidth percent 25
  R5(config-pmap-c)#class class-default
  R5(config-pmap-c)#bandwidth percent 15
  R5(config-pmap-c)#exit
  R5(config-pmap)#exit

  Step 3: Apply the output service policy to the core-layer-facing interface as shown in the configuration example below:

  R5(config)#int g1/1
  R5(config-if)#service-policy output QOS_POLICY
  R5(config-if)#exit
  R5(config)#int g1/2
  R5(config-if)#service-policy output QOS_POLICY
  R5(config-if)#end

check_text:
  Review the router configuration and verify that a QoS policy has been configured to provide preferred treatment for mission-critical applications.

  Step 1: Verify that the class-maps are configured to match on DSCP values as shown in the configuration example below:

  class-map match-all C2_VOICE
   match ip dscp af47
  class-map match-all VOICE
   match ip dscp ef
  class-map match-all VIDEO
   match ip dscp af41
  class-map match-all CONTROL_PLANE
   match ip dscp cs6
  class-map match-all PREFERRED_DATA
   match ip dscp af33

  Step 2: Verify that the policy map reserves the bandwidth for each traffic type as shown in the following example:

  policy-map QOS_POLICY
  class C2_VOICE
      priority percent 10
   class VOICE
      priority percent 15
   class VIDEO
      bandwidth percent 25
  class CONTROL_PLANE
      priority percent 10
   class PREFERRED_DATA
      bandwidth percent 25
   class class-default
      bandwidth percent 15

  Step 3: Verify that an output service policy is bound to all interfaces as shown in the configuration example below:

  interface GigabitEthernet1/1
   ip address 10.1.15.1 255.255.255.252
   service-policy output QOS_POLICY
  !
  interface GigabitEthernet1/2
   ip address 10.1.15.4 255.255.255.252
   service-policy output QOS_POLICY

  Note: Enclaves must mark or re-mark their traffic to be consistent with the DODIN backbone admission criteria to gain the appropriate level of service. A general DiffServ principle is to mark or trust traffic as close to the source as administratively and technically possible. However, certain traffic types might need to be re-marked before handoff to the DODIN backbone to gain admission to the correct class. If such re-marking is required, it is recommended that the re-marking be performed at the CE egress edge.

  If the router is not configured to enforce a QoS policy in accordance with the QoS DODIN Technical Profile, this is a finding.


vuln_id: V-216715
rule_id: SV-216715r917436_rule
severity: CAT III
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco P router must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications.

description:
  <VulnDiscussion>Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy.

  Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure to enforce a QoS policy to provide preferred treatment for mission-critical applications.

  Step 1: Configure class-maps to match on DSCP values as shown in the configuration example below:

  R5(config)#class-map match-all PREFERRED_DATA
  R5(config-cmap)#match ip dscp af33
  R5(config-cmap)#class-map match-all CONTROL_PLANE
  R5(config-cmap)#match ip dscp cs6
  R5(config-cmap)#class-map match-all VIDEO
  R5(config-cmap)#match ip dscp af41
  R5(config-cmap)#class-map match-all VOICE
  R5(config-cmap)#match ip dscp ef
  R5(config-cmap)#class-map match-all C2_VOICE
  R5(config-cmap)#match ip dscp 47
  R5(config-cmap)#exit

  Step 2: Configure a policy map to be applied to the core-layer-facing interface that  reserves the bandwidth for each traffic type as shown in the example below:

  R5(config)#policy-map QOS_POLICY
  R5(config-pmap)#class CONTROL_PLANE
  R5(config-pmap-c)#priority percent 10
  R5(config-pmap-c)#class C2_VOICE
  R5(config-pmap-c)#priority percent 10
  R5(config-pmap-c)#class VOICE
  R5(config-pmap-c)#priority percent 15
  R5(config-pmap-c)#class VIDEO
  R5(config-pmap-c)#bandwidth percent 25
  R5(config-pmap-c)#class PREFERRED_DATA
  R5(config-pmap-c)#bandwidth percent 25
  R5(config-pmap-c)#class class-default
  R5(config-pmap-c)#bandwidth percent 15
  R5(config-pmap-c)#exit
  R5(config-pmap)#exit

  Step 3: Apply the output service policy to all interfaces as shown in the configuration example below:

  R5(config)#int g1/1
  R5(config-if)#service-policy output QOS_POLICY
  R5(config-if)#exit
  R5(config)#int g1/2
  R5(config-if)#service-policy output QOS_POLICY
  R5(config-if)#end

check_text:
  Review the router configuration and verify that a QoS policy has been configured to provide preferred treatment for mission-critical applications.

  Step 1: Verify that the class-maps are configured to match on DSCP values as shown in the configuration example below:

  class-map match-all PREFERRED_DATA
   match ip dscp af33
  class-map match-all CONTROL_PLANE
   match ip dscp cs6
  class-map match-all VIDEO
   match ip dscp af41
  class-map match-all VOICE
   match ip dscp ef
  class-map match-all C2_VOICE
   match ip dscp 47

  Step 2: Verify that the policy map reserves the bandwidth for each traffic type as shown in the following example:

  policy-map QOS_POLICY
   class CONTROL_PLANE
      priority percent 10
   class C2_VOICE
      priority percent 10
   class VOICE
      priority percent 15
   class VIDEO
      bandwidth percent 25
   class PREFERRED_DATA
      bandwidth percent 25
   class class-default
      bandwidth percent 15

  Step 3: Verify that an output service policy is bound to all interfaces as shown in the configuration example below:

  interface GigabitEthernet1/1
   ip address 10.1.15.5 255.255.255.252
   service-policy output QOS_POLICY
  !
  interface GigabitEthernet1/2
   ip address 10.1.15.8 255.255.255.252
   service-policy output QOS_POLICY

  If the router is not configured to implement a QoS policy in accordance with the QoS DODIN Technical Profile, this is a finding.


vuln_id: V-216716
rule_id: SV-216716r531086_rule
severity: CAT II
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial of service (DoS) attacks.

description:
  <VulnDiscussion>DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed denial of service (DDoS) attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch using readily available tools such as Low Orbit Ion Cannon or botnets. 

  Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure a class map for the SCAVENGER class.

  R5(config)#class-map match-all SCAVENGER
  R5(config-cmap)#match ip dscp cs1

  Step 2: Add the SCAVENGER class to the policy map as shown in the example below:

  R5(config)#policy-map QOS_POLICY
  R5(config-pmap-c)#no class class-default
  R5(config-pmap)#class SCAVENGER
  R5(config-pmap-c)#bandwidth percent 5
  R5(config-pmap-c)#class class-default
  R5(config-pmap-c)#bandwidth percent 10
  R5(config-pmap-c)#end

check_text:
  Review the router configuration to determine if it is configured to enforce a QoS policy to limit the effects of packet flooding DoS attacks.

  Step 1: Verify that a class map has been configured for the Scavenger class as shown in the example below.

  class-map match-all SCAVENGER
   match ip dscp cs1

  Step 2: Verify that the policy map includes the SCAVENGER class with low priority as shown in the following example below. 

  policy-map QOS_POLICY
   class CONTROL_PLANE
      priority percent 10
   class C2_VOICE
      priority percent 10
   class VOICE
      priority percent 15
   class VIDEO
      bandwidth percent 25
   class PREFERRED_DATA
      bandwidth percent 25
  class SCAVENGER
      bandwidth percent 5
   class class-default
      bandwidth percent 10

  Note: Traffic out of profile must be marked at the customer access layer or CE egress edge.

  If the router is not configured to enforce a QoS policy to limit the effects of packet flooding DoS attacks, this is a finding.


vuln_id: V-216717
rule_id: SV-216717r531086_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

description:
  <VulnDiscussion>If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Limiting where, within the network, a given multicast group's data is permitted to flow is an important first step in improving multicast security. 

  A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"; that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. 

  As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Therefore, it is imperative that the network engineers have documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once this is done, the zones can be scoped as required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document all enabled interfaces for PIM in the network's multicast topology diagram. Disable support for PIM on interfaces that are not required to support it.

  R5(config)#int g1/1
  R5(config-if)#no ip pim sparse-mode

check_text:
  Step 1: Review the network's multicast topology diagram.

  Step 2:  Review the router configuration to verify that only the PIM interfaces as shown in the multicast topology diagram are enabled for PIM as shown in the example below:

  interface GigabitEthernet1/1
   ip address 10.1.3.3 255.255.255.0
   ip pim sparse-mode

  If an interface is not required to support multicast routing and it is enabled, this is a finding.


vuln_id: V-216718
rule_id: SV-216718r531086_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

description:
  <VulnDiscussion>PIM is a routing protocol used to build multicast distribution trees for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled. If a PIM neighbor filter is not applied to those interfaces that have PIM enabled, unauthorized routers can join the PIM domain, discover and use the rendezvous points, and also advertise their rendezvous points into the domain. This can result in a denial of service by traffic flooding or result in the unauthorized transfer of data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure neighbor ACLs to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor ACLs to all PIM enabled interfaces.

  Step 1: Configure ACL for PIM neighbors.

  R2(config)#ip access-list standard PIM_NEIGHBORS
  R2(config-std-nacl)#permit 10.1.2.6
  R2(config-std-nacl)#exit

  Step 2: Apply the ACL to all interfaces enabled for PIM.

  R2(config)#int g1/1
  R2(config-if)#ip pim neighbor-filter PIM_NEIGHBORS

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Verify all interfaces enabled for PIM have a neighbor ACL bound to the interface as shown in the example below:

  interface GigabitEthernet1/1
   ip address 10.1.2.2 255.255.255.0
   ip pim neighbor-filter PIM_NEIGHBORS
   ip pim sparse-mode

  Step 2: Review the configured ACL for filtering PIM neighbors as shown in the example below:

  ip access-list standard PIM_NEIGHBORS
   permit 10.1.2.6

  If PIM neighbor ACLs are not bound to all interfaces that have PIM enabled, this is a finding.


vuln_id: V-216719
rule_id: SV-216719r531086_rule
severity: CAT III
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.

description:
  <VulnDiscussion>If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel.

  Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Administrative scoped multicast traffic must not cross the enclave perimeter in either direction. Restricting multicast traffic makes it more difficult for a malicious user to access sensitive traffic.

  Admin-Local scope is encouraged for any multicast traffic within a network intended for network management, as well as for control plane traffic that must reach beyond link-local destinations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure the ACL to deny packets with multicast administratively scoped destination addresses as shown in the example below:

  R2(config)#ip access-list standard MULTICAST_SCOPE
  R2(config-std-nacl)#deny 239.0.0.0 0.255.255.255
  R2(config-std-nacl)#permit any
  R2(config-std-nacl)#exit 

  Step 2: Apply the multicast boundary at the appropriate interfaces as shown in the example below:

  R2(config)#int g1/2
  R2(config-if)#ip multicast boundary MULTICAST_SCOPE
  R2(config-if)#end

check_text:
  Review the router configuration and verify that admin-scope multicast traffic is blocked at the external edge as shown in the example below:

  interface GigabitEthernet1/2
   ip address x.1.12.2 255.255.255.252
   ip pim sparse-mode
   ip multicast boundary MULTICAST_SCOPE
  …
  …
  …
  ip access-list standard MULTICAST_SCOPE
   deny   239.0.0.0 0.255.255.255
   permit any

  If the router is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.


vuln_id: V-216720
rule_id: SV-216720r864164_rule
severity: CAT III
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.

description:
  <VulnDiscussion>MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial of service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The risk associated with this requirement can be fully mitigated by configuring the router to filter PIM register messages, rate limiting the number of PIM register messages, and accept MSDP packets only from known MSDP peers.

  Step 1: Configure the router to filter PIM register messages received from a multicast DR for any undesirable multicast groups and sources. The example below will deny any multicast streams for groups 239.5.0.0/16 and allow from only sources 10.1.2.6 and 10.1.2.7. 

  R2(config)#ip access-list extended PIM_REGISTER_FILTER
  R2(config-ext-nacl)#deny ip any 239.5.0.0 0.0.255.255
  R2(config-ext-nacl)#permit ip host 10.1.2.6 any
  R2(config-ext-nacl)#permit ip host 10.1.2.7 any
  R2(config-ext-nacl)#deny ip any any
  R2(config-ext-nacl)#exit
  R2(config)#ip pim accept-register list PIM_REGISTER_FILTER
  R2(config)#end 

  Step 2: Configure the RP to rate limit the number of multicast register messages.

  R2(config)#ip pim register-rate-limit nn

  Step 3: Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.

  R8(config)#ip access-list extended EXTERNAL_ACL_INBOUND
  R8(config-ext-nacl)#permit tcp any any established
  R8(config-ext-nacl)#permit tcp host x.1.28.2 host x.1.28.8 eq 639
  R8(config-ext-nacl)#deny tcp any host x.1.28.8 eq 639
  R8(config-ext-nacl)#permit tcp host x.1.28.2 host x.1.28.8 eq bgp
  R8(config-ext-nacl)#permit tcp host x.1.28.2 eq bgp host x.1.28.8
  R8(config-ext-nacl)#permit pim host x.1.28.2 host x.1.28.8
  …
  …
  …
  R8(config-ext-nacl)#deny ip any any

check_text:
  The Cisco router does not have a mechanism to limit the multicast forwarding cache. However, the risk associated with this requirement can be fully mitigated by configuring the router to:

  1. Filter PIM register messages.
  2. Rate limiting the number of PIM register messages.
  3. Accept MSDP packets only from known MSDP peers.

  Step 1:  Verify that the RP router is configured to filter PIM register messages for any undesirable multicast groups and sources. The example below will deny any multicast streams for groups 239.5.0.0/16 and allow from only sources 10.1.2.6 and 10.1.2.7. 

  ip pim rp-address 10.1.12.3
  ip pim accept-register list PIM_REGISTER_FILTER
  …
  …
  …
  ip access-list extended PIM_REGISTER_FILTER
   deny   ip any 239.5.0.0 0.0.255.255
   permit ip host 10.1.2.6 any
   permit ip host 10.1.2.7 any
   deny   ip any any

  Step 2: Verify that the router is configured to rate limiting the number of PIM register messages as shown in the example below.

  ip pim rp-address 10.2.2.2
  ip pim register-rate-limit nn

  Step 3: Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers as shown in the example below.

  Step 3a: Verify that interfaces used for MSDP peering have an inbound ACL as shown in the example.

  interface GigabitEthernet1/1
   ip address x.1.28.8 255.255.255.0
   ip access-group EXTERNAL_ACL_INBOUND in
   ip pim sparse-mode

  Step 3b: Verify that the ACL restricts MSDP peering to only known sources.

  ip access-list extended EXTERNAL_ACL_INBOUND
   permit tcp any any established
   permit tcp host x.1.28.2 host x.1.28.8 eq 639
   deny   tcp any host x.1.28.8 eq 639 log
   permit tcp host x.1.28.2 host 10.1.28.8 eq bgp
   permit tcp host x.1.28.2 eq bgp host x.1.28.8
   permit pim host x.1.28.2 pim host x.1.28.8
   …
   …
   …
   deny ip any any log

  Note: MSDP connections is via TCP port 639

  If the RP router is not configured to filter PIM register messages, rate limiting the number of PIM register messages, and accept MSDP packets only from known MSDP peers, this is a finding.


vuln_id: V-216721
rule_id: SV-216721r531086_rule
severity: CAT III
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated Router (DR) for any undesirable multicast groups and sources.

description:
  <VulnDiscussion>Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial of service (DoS) condition. Hence, it is imperative that register messages are accepted only for authorized multicast groups and sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to filter PIM register messages received from a multicast DR for any undesirable multicast groups and sources. The example below will deny any multicast streams for groups 239.5.0.0/16 and allow from only sources 10.1.2.6 and 10.1.2.7. 

  R2(config)#ip access-list extended PIM_REGISTER_FILTER
  R2(config-ext-nacl)#deny ip any 239.5.0.0 0.0.255.255
  R2(config-ext-nacl)#permit ip host 10.1.2.6 any
  R2(config-ext-nacl)#permit ip host 10.1.2.7 any
  R2(config-ext-nacl)#deny ip any any
  R2(config-ext-nacl)#exit
  R2(config)#ip pim accept-register list PIM_REGISTER_FILTER
  R2(config)#end

check_text:
  Verify that the RP router is configured to filter PIM register messages. The example below will deny any multicast streams for groups 239.5.0.0/16 and allow from only sources 10.1.2.6 and 10.1.2.7. 

  ip pim rp-address 10.1.12.3
  ip pim accept-register list PIM_REGISTER_FILTER
  …
  …
  …
  ip access-list extended PIM_REGISTER_FILTER
   deny   ip any 239.5.0.0 0.0.255.255
   permit ip host 10.1.2.6 any
   permit ip host 10.1.2.7 any
   deny   ip any any

  If the RP router peering with PIM-SM routers is not configured with a policy to block registration messages for any undesirable multicast groups and sources, this is a finding.


vuln_id: V-216722
rule_id: SV-216722r531086_rule
severity: CAT III
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.

description:
  <VulnDiscussion>Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial of service (DoS) condition. Hence, it is imperative that join messages are only accepted for authorized multicast groups.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the RP to filter PIM join messages for any undesirable multicast groups as shown in the example below:

  R2(config)#ip access-list standard PIM_JOIN_FILTER
  R2(config-std-nacl)#deny 239.8.0.0 0.0.255.255
  R2(config-std-nacl)#permit any
  R2(config-std-nacl)#exit
  R2(config)#ip pim accept-rp 10.2.2.2 PIM_JOIN_FILTER 
  R2(config)#end

check_text:
  Verify that the RP router is configured to filter PIM join messages for any undesirable multicast groups. In the example below, groups from 239.8.0.0/16 are not allowed.

  ip pim rp-address 10.2.2.2
  ip pim accept-rp 10.2.2.2 FILTER_PIM_JOINS
  …
  …
  …
  ip access-list standard FILTER_PIM_JOINS
   deny   239.8.0.0 0.0.255.255
   permit any
  !

  If the RP is not configured to filter join messages received from the DR for any undesirable multicast groups, this is a finding.


vuln_id: V-216723
rule_id: SV-216723r855829_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.

description:
  <VulnDiscussion>When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the RP to rate limit the number of multicast register messages.

  R2(config)#ip pim register-rate-limit nn

check_text:
  Review the configuration of the RP to verify that it is rate limiting the number of PIM register messages.

  ip pim rp-address 10.2.2.2
  ip pim register-rate-limit nn

  If the RP is not limiting PIM register messages, this is a finding.


vuln_id: V-216724
rule_id: SV-216724r864165_rule
severity: CAT III
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.

description:
  <VulnDiscussion>Real-time multicast traffic can entail multiple large flows of data. Large unicast flows tend to be fairly isolated (i.e., someone doing a file download here or there), whereas multicast can have broader impact on bandwidth consumption, resulting in extreme network congestion. Hence, it is imperative that there is multicast admission control to restrict which multicast groups hosts are allowed to join via IGMP or MLD.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the DR to filter the IGMP or MLD Membership Report messages to allow hosts to join only those multicast groups that have been approved.

  Step 1: Configure the ACL to filter IGMP Membership Report messages as shown in the example. 

  R3(config)#ip access-list standard IGMP_JOIN_FILTER
  R3(config-std-nacl)#deny 239.8.0.0 0.0.255.255
  R3(config-std-nacl)#permit any
  R3(config-std-nacl)#exit

  Step 2: Apply the filter to all host facing interfaces.

  R3(config)#int g0/0
  R3(config-if)#ip igmp access-group IGMP_JOIN_FILTER

check_text:
  Review the configuration of the DR to verify that it is filtering IGMP or MLD Membership Report messages, allowing hosts to join only those groups that have been approved.

  Step 1: Verify that all host facing interfaces are configured to filter IGMP Membership Report messages (IGMP joins) as shown in the example below:

  interface GigabitEthernet0/0
   ip address 10.3.3.3 255.255.255.0
   ip pim sparse-mode
   ip igmp access-group IGMP_JOIN_FILTER
   ip igmp version 3

  Step 2: Verify that the ACL denies unauthorized groups or permits only authorized groups. The example below denies all groups from 239.8.0.0/16 range.

  ip access-list standard IGMP_JOIN_FILTER
   deny   239.8.0.0 0.0.255.255
   permit any

  Note: This requirement is only applicable to Source Specific Multicast (SSM) implementation. This requirement is not applicable to Any Source Multicast (ASM) since the filtering is being performed by the Rendezvous Point router.

  If the DR is not filtering IGMP or MLD Membership Report messages, this is a finding.


vuln_id: V-216725
rule_id: SV-216725r864166_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.

description:
  <VulnDiscussion>Real-time multicast traffic can entail multiple large flows of data. Large unicast flows tend to be fairly isolated (i.e., someone doing a file download here or there), whereas multicast can have broader impact on bandwidth consumption, resulting in extreme network congestion. Hence, it is imperative that there is multicast admission control to restrict which multicast groups hosts are allowed to join via IGMP or MLD.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the DR to filter the IGMP and MLD report messages to allow hosts to join only those multicast groups from sources that have been approved as shown in the example.

  R3(config)#ip access-list extended IGMP_JOIN_FILTER
  R3(config-ext-nacl)#deny ip any 232.8.0.0 0.0.255.255
  R3(config-ext-nacl)#permit ip x.0.0.0 0.255.255.255 any
  R3(config-ext-nacl)#deny ip any any
  R3(config-ext-nacl)#exit

  Step 2: Apply the filter to all host facing interfaces.

  R3(config)#int g0/0
  R3(config-if)#ip igmp access-group IGMP_JOIN_FILTER

check_text:
  Review the configuration of the DR to verify that it is filtering IGMP or MLD report messages, allowing hosts to only join multicast groups from sources that have been approved.

  Step 1: Verify that all host-facing interfaces are configured to filter IGMP Membership Report messages (IGMP joins) as shown in the example below:

  interface GigabitEthernet0/0
   ip address 10.3.3.3 255.255.255.0
   ip pim sparse-mode
   ip igmp access-group IGMP_JOIN_FILTER
   ip igmp version 3

  Step 2: Verify that the ACL denies unauthorized sources or allows only authorized sources. The example below denies all groups from 232.8.0.0/16 range and permits sources only from the x.0.0.0/8 network.

  ip access-list extended IGMP_JOIN_FILTER
   deny   ip any 232.8.0.0 0.0.255.255
   permit ip x.0.0.0 0.255.255.255 any
   deny   ip any any

  Note: This requirement is only applicable to Source Specific Multicast (SSM) implementation.

  If the DR is not filtering IGMP or MLD report messages, this is a finding.


vuln_id: V-216726
rule_id: SV-216726r855832_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.

description:
  <VulnDiscussion>The current multicast paradigm can let any host join any multicast group at any time by sending an IGMP or MLD membership report to the DR. In a Protocol Independent Multicast (PIM) Sparse Mode network, the DR will send a PIM Join message for the group to the RP. Without any form of admission control, this can pose a security risk to the entire multicast domain, specifically the multicast routers along the shared tree from the DR to the RP that must maintain the mroute state information for each group join request. Hence, it is imperative that the DR is configured to limit the number of mroute state information that must be maintained to mitigate the risk of IGMP or MLD flooding.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the DR on a global or interface basis to limit the number of mroute states resulting from IGMP or MLD membership reports.

  R3(config)#int g0/0
  R3(config-if)#ip igmp limit 2

check_text:
  Review the DR configuration to verify that it is limiting the number of mroute states via IGMP or MLD.

  Verify IGMP limits have been configured globally or on each host-facing interface via the ip igmp limit command as shown in the example.

  interface GigabitEthernet0/0
   ip address 10.3.3.3 255.255.255.0
   …
   …
   …
   ip igmp limit nn

  If the DR is not limiting multicast join requests via IGMP or MLD on a global or interfaces basis, this is a finding.


vuln_id: V-216727
rule_id: SV-216727r945856_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco multicast Designated Router (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.

description:
  <VulnDiscussion>ASM can have many sources for the same groups (many-to-many). For many receivers, the path via the RP may not be ideal compared with the shortest path from the source to the receiver. By default, the last-hop router will initiate a switch from the shared tree to a source-specific SPT to obtain lower latencies. This is accomplished by the last-hop router sending an (S, G) Protocol Independent Multicast (PIM) Join toward S (the source).

  When the last-hop router begins to receive traffic for the group from the source via the SPT, it will send a PIM Prune message to the RP for the (S, G). The RP will then send a Prune message toward the source. The SPT switchover becomes a scaling issue for large multicast topologies that have many receivers and many sources for many groups because (S, G) entries require more memory than (*, G). Hence, it is imperative to minimize the amount of (S, G) state to be maintained by increasing the threshold that determines when the SPT switchover occurs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the DR to increase the SPT threshold or set it to infinity to minimalize (S, G) state within the multicast topology where ASM is deployed.

  R3(config)#ip pim spt-threshold infinity

check_text:
  Review the DR configuration to verify that the SPT switchover threshold is increased (default is "0") or set to infinity (never switch over). 

  ip pim rp-address 10.2.2.2
  ip pim spt-threshold infinity

  If the DR is not configured to increase the SPT threshold or set to infinity to minimalize (S, G) state, this is a finding.


vuln_id: V-216728
rule_id: SV-216728r855834_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

description:
  <VulnDiscussion>MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP routers must be configured to only accept MSDP packets from known MSDP peers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.

  R8(config)#ip access-list extended EXTERNAL_ACL_INBOUND
  R8(config-ext-nacl)#permit tcp any any established
  R8(config-ext-nacl)#permit tcp host x.1.28.2 host x.1.28.8 eq 639
  R8(config-ext-nacl)#deny tcp any host x1.28.8 eq 639
  R8(config-ext-nacl)#permit tcp host x.1.28.2 host x.1.28.8 eq bgp
  R8(config-ext-nacl)#permit tcp host x.1.28.2 eq bgp host x.1.28.8
  R8(config-ext-nacl)#permit pim host x.1.28.2 host x.1.28.8
  …
  …
  …
  R8(config-ext-nacl)#deny ip any any

check_text:
  Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.

  Step 1: Verify that interfaces used for MSDP peering have an inbound ACL as shown in the example.

  interface GigabitEthernet1/1
   ip address x.1.28.8 255.255.255.0
   ip access-group EXTERNAL_ACL_INBOUND in
   ip pim sparse-mode

  Step 2: Verify that the ACL restricts MSDP peering to only known sources.

  ip access-list extended EXTERNAL_ACL_INBOUND
   permit tcp any any established
   permit tcp host x.1.28.2 host x.1.28.8 eq 639
   deny   tcp any host x.1.28.8 eq 639 log
   permit tcp host x.1.28.2 host 10.1.28.8 eq bgp
   permit tcp host x.1.28.2 eq bgp host x.1.28.8
   permit pim host x.1.28.2 pim host x.1.28.8
   …
   …
   …
   deny ip any any log

  Note: MSDP connections is via TCP port 639.

  If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.


vuln_id: V-216729
rule_id: SV-216729r855835_rule
severity: CAT II
cci: CCI-001958
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to authenticate all received MSDP packets.

description:
  <VulnDiscussion>MSDP peering with customer network routers presents additional risks to the core, whether from a rogue or misconfigured MSDP-enabled router. MSDP password authentication is used to validate each segment sent on the TCP connection between MSDP peers, protecting the MSDP session against the threat of spoofed packets being injected into the TCP connection stream.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to authenticate MSDP messages as shown in the following example:

  R2(config)#ip msdp password peer x.1.28.8 xxxxxxxxxxxx

check_text:
  Review the router configuration to determine if received MSDP packets are authenticated.

  ip msdp peer x.1.28.8 remote-as 8
  ip msdp password peer x.1.28.8 xxxxxxxxxxxx

  If the router does not require MSDP authentication, this is a finding.


vuln_id: V-216730
rule_id: SV-216730r531086_rule
severity: CAT III
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to filter received source-active multicast advertisements for any undesirable multicast groups and sources.

description:
  <VulnDiscussion>The interoperability of BGP extensions for interdomain multicast routing and MSDP enables seamless connectivity of multicast domains between autonomous systems. MP-BGP advertises the unicast prefixes of the multicast sources used by Protocol Independent Multicast (PIM) routers to perform RPF checks and build multicast distribution trees. MSDP is a mechanism used to connect multiple PIM sparse-mode domains, allowing RPs from different domains to share information about active sources. When RPs in peering multicast domains hear about active sources, they can pass on that information to their local receivers, thereby allowing multicast data to be forwarded between the domains. Configuring an import policy to block multicast advertisements for reserved, Martian, single-source multicast, and any other undesirable multicast groups, as well as any source-group (S, G) states with Bogon source addresses, would assist in avoiding unwanted multicast traffic from traversing the core.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the MSDP router to filter received source-active multicast advertisements for any undesirable multicast groups and sources as shown in the example below:

  R8(config)#ip access-list extended INBOUND_MSDP_SA_FILTER
  R8(config-ext-nacl)#deny ip any host 224.0.1.3                       ! Rwhod 
  R8(config-ext-nacl)#deny ip any host 224.0.1.24                     ! Microsoft-ds
  R8(config-ext-nacl)#deny ip any host 224.0.1.22                     ! SVRLOC
  R8(config-ext-nacl)#deny ip any host 224.0.1.2                       ! SGI-Dogfight
  R8(config-ext-nacl)#deny ip any host 224.0.1.35                    ! SVRLOC-DA
  R8(config-ext-nacl)#deny ip any host 224.0.1.60                    ! hp-device-disc
  R8(config-ext-nacl)#deny ip any host 224.0.1.39                     ! Auto-RP
  R8(config-ext-nacl)#deny ip any host 224.0.1.40                     ! Auto-RP
  R8(config-ext-nacl)#deny ip any 232.0.0.0 0.255.255.255     ! SSM range
  R8(config-ext-nacl)#deny ip any 239.0.0.0 0.255.255.255     ! Admin scoped range
  R8(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any       ! RFC 1918 address range
  R8(config-ext-nacl)#deny ip 127.0.0.0 0.255.255.255 any     ! RFC 1918 address range
  R8(config-ext-nacl)#deny ip 172.16.0.0 0.15.255.255 any     ! RFC 1918 address range
  R8(config-ext-nacl)#deny ip 192.168.0.0 0.0.255.255 any   ! RFC 1918 address range
  R8(config-ext-nacl)#permit ip any any
  R8(config-ext-nacl)#exit
  R8(config)#ip msdp sa-filter in x.1.28.2 list INBOUND_MSDP_SA_FILTER

check_text:
  Review the router configuration to determine if there is import policy to block source-active multicast advertisements for any undesirable multicast groups, as well as any (S, G) states with undesirable source addresses. 

  Step 1: Verify that an inbound source-active filter is bound to each MSDP peer.

  ip msdp peer x.1.28.2 remote-as 2
  ip msdp sa-filter in x.1.28.2 list INBOUND_MSDP_SA_FILTER

  Step 2: Review the access lists referenced by the source-active filter to verify that undesirable multicast groups, auto-RP, single source multicast (SSM) groups, and advertisements from undesirable sources are blocked.

  ip access-list extended INBOUND_MSDP_SA_FILTER
   deny   ip any host 224.0.1.3
   deny   ip any host 224.0.1.24
   deny   ip any host 224.0.1.22
   deny   ip any host 224.0.1.2
   deny   ip any host 224.0.1.35
   deny   ip any host 224.0.1.60
   deny   ip any host 224.0.1.39
   deny   ip any host 224.0.1.40
   deny   ip any 232.0.0.0 0.255.255.255
   deny   ip any 239.0.0.0 0.255.255.255
   deny   ip 10.0.0.0 0.255.255.255 any
   deny   ip 127.0.0.0 0.255.255.255 any
   deny   ip 172.16.0.0 0.15.255.255 any
   deny   ip 192.168.0.0 0.0.255.255 any
   permit ip any any

  If the router is not configured with an import policy to filter undesirable SA multicast advertisements, this is a finding.


vuln_id: V-216731
rule_id: SV-216731r531086_rule
severity: CAT III
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

description:
  <VulnDiscussion>To avoid global visibility of local information, there are a number of source-group (S, G) states in a PIM-SM domain that must not be leaked to another domain, such as multicast sources with private address, administratively scoped multicast addresses, and the auto-RP groups (224.0.1.39 and 224.0.1.40).

  Allowing a multicast distribution tree, local to the core, to extend beyond its boundary could enable local multicast traffic to leak into other autonomous systems and customer networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router with an export policy avoid global visibility of local multicast (S, G) states. The example below will prevent exporting multicast active sources belonging to the private network.

  R8(config)#ip access-list extended OUTBOUND_MSDP_SA_FILTER
  R8(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any
  R8(config-ext-nacl)#permit ip any any
  R8(config-ext-nacl)#exit
  R8(config)#ip msdp sa-filter in x.1.28.2 list OUTBOUND_MSDP_SA_FILTER

check_text:
  Review the router configuration to determine if there is export policy to block local source-active multicast advertisements.

  Step 1: Verify that an outbound source-active filter is bound to each MSDP peer as shown in the example below:

  ip msdp peer 10.1.28.8 remote-as 8
  ip msdp sa-filter out 10.1.28.8 list OUTBOUND_MSDP_SA_FILTER

  Step 2: Review the access lists referenced by the source-active filters and verify that MSDP source-active messages being sent to MSDP peers do not leak advertisements that are local.

  ip access-list extended OUTBOUND_MSDP_SA_FILTER
   deny   ip 10.0.0.0 0.255.255.255 any
   permit ip any any

  If the router is not configured with an export policy to filter local source-active multicast advertisements, this is a finding.


vuln_id: V-216732
rule_id: SV-216732r531086_rule
severity: CAT III
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to limit the amount of source-active messages it accepts on a per-peer basis.

description:
  <VulnDiscussion>To reduce any risk of a denial of service (DoS) attack from a rogue or misconfigured MSDP router, the router must be configured to limit the number of source-active messages it accepts from each peer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to limit the amount of source-active messages it accepts from each peer.

  R8(config)#ip msdp sa-limit x.1.28.2 nnn

check_text:
  Review the router configuration to determine if it is configured to limit the amount of source-active messages it accepts on a per-peer basis.

  ip msdp peer x.1.28.2 remote-as nn
  ip msdp sa-filter in 10.1.28.2 list MSDP_SA_FILTER
  ip msdp sa-limit X.1.28.2 nnn

  If the router is not configured to limit the source-active messages it accepts, this is a finding.


vuln_id: V-216733
rule_id: SV-216733r991901_rule
severity: CAT III
cci: CCI-004931
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to use a loopback address as the source address when originating MSDP traffic.

description:
  <VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of MSDP routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to use its loopback address is used as the source address when sending MSDP packets.

  R2(config)#ip msdp peer x.44.2.34 connect-source lo12 remote-as nn

check_text:
  Verify that the loopback interface is used as the source address for all MSDP packets generated by the router.

  ip msdp peer x.44.2.34 connect-source Loopback12 remote-as nn

  If the router does not use its loopback address as the source address when originating MSDP traffic, this is a finding.


vuln_id: V-216997
rule_id: SV-216997r945858_rule
severity: CAT I
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

description:
  <VulnDiscussion>A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack other computers or networks. DDoS attacks frequently leverage IP source address spoofing to send packets to multiple hosts that in turn will then send return traffic to the hosts with the IP addresses that were forged. This can generate significant amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet, thereby mitigating IP source address spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to ensure that an egress ACL or uRPF is configured on internal interfaces to restrict the router from accepting any outbound IP packet that contains an illegitimate address in the source field. The example below enables uRPF.

  R5(config)#int g0/1
  R5(config-if)#ip verify unicast source reachable-via rx

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify uRPF or an egress ACL has been configured on all internal interfaces to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field.

  uRPF example:

  interface GigabitEthernet0/1
   description downstream link to LAN
   ip address 10.1.25.5 255.255.255.0
   ip verify unicast source reachable-via rx

  Egress ACL example:

  interface GigabitEthernet0/1
   description downstream link to LAN
   ip address 10.1.25.5 255.255.255.0
   ip access-group EGRESS_FILTER in
  …
  …
  …
  ip access-list extended EGRESS_FILTER
   permit udp 10.1.15.0 0.0.0.255 any eq domain
   permit tcp 10.1.15.0 0.0.0.255 any eq ftp
   permit tcp 10.1.15.0 0.0.0.255 any eq ftp-data
   permit tcp 10.1.15.0 0.0.0.255 any eq www
   permit icmp 10.1.15.0 0.0.0.255 any
   permit icmp 10.1.15.0 0.0.0.255 any echo
   deny   ip any any

  If uRPF or an egress ACL to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces in an enclave, this is a finding.


vuln_id: V-216998
rule_id: SV-216998r945859_rule
severity: CAT II
title: The Cisco perimeter router must be configured to block all packets with any IP options.
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Packets with IP options are not fast switched and henceforth must be punted to the router processor. Hackers who initiate denial of service (DoS) attacks on routers commonly send large streams of packets with IP options. Dropping the packets with IP options reduces the load of IP options packets on the router. The end result is a reduction in the effects of the DoS attack on the router and on downstream routers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to drop all packets with IP options.

  R1(config)#ip access-list extended EXTERNAL_ACL
  R1(config-ext-nacl)#15 deny ip any any option any-options

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to determine if it will block all packets with IP options.

  ip access-list extended EXTERNAL_ACL
   permit tcp any any established
  deny   ip any any option any-options
  permit …
   …
   …     
   …
  deny   ip any any log-input

  If the router is not configured to drop all packets with IP options, this is a finding.


vuln_id: V-216999
rule_id: SV-216999r855842_rule
severity: CAT III
title: The Cisco BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>As described in RFC 3682, GTSM is designed to protect a router's IP-based control plane from denial of service (DoS) attacks. Many attacks focused on CPU load and line-card overload can be prevented by implementing GTSM on all Exterior Border Gateway Protocol-speaking routers. 

  GTSM is based on the fact that the vast majority of control plane peering is established between adjacent routers; that is, the Exterior Border Gateway Protocol peers are either between connecting interfaces or between loopback interfaces. Since TTL spoofing is considered nearly impossible, a mechanism based on an expected TTL value provides a simple and reasonably robust defense from infrastructure attacks based on forged control plane traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure TTL security on all external BGP neighbors as shown in the example below:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 ttl-security hops 1
  R1(config-router)#neighbor x.2.1.7 ttl-security hops 1

check_text:
  Review the BGP configuration to verify that TTL security has been configured for each external neighbor as shown in the example below:

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 password xxxxxxxx
   neighbor x.1.1.9 ttl-security hops 1
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 password xxxxxxxx
   neighbor x.2.1.7 ttl-security hops 1

  If the router is not configured to use GTSM for all Exterior Border Gateway Protocol peering sessions, this is a finding.


vuln_id: V-217000
rule_id: SV-217000r945862_rule
severity: CAT II
cci: CCI-002205
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

description:
  <VulnDiscussion>If the same keys are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It is possible that a malicious user exists in one autonomous system who would know the key used for the eBGP session. This user would then be able to hijack BGP sessions with other trusted neighbors.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to use unique keys for each AS that it peers with as shown in the example below:

  R1(config)#router bgp xx
  R1(config-router)#neighbor x.1.1.9 password yyyyyyyy 
  R1(config-router)#neighbor x.2.1.7 password zzzzzzzzz

check_text:
  This check is Not Applicable for JRSS internal EBGP use.

  Review the BGP configuration to determine if it is peering with multiple autonomous systems. Interview the ISSM and router administrator to determine if unique keys are being used. 

  router bgp xx
   no synchronization
   bgp log-neighbor-changes
   neighbor x.1.1.9 remote-as yy
   neighbor x.1.1.9 password yyyyyyyy
   neighbor x.2.1.7 remote-as zz
   neighbor x.2.1.7 password zzzzzzzzz

  If unique keys are not being used, this is a finding.


vuln_id: V-217001
rule_id: SV-217001r945860_rule
severity: CAT II
title: The Cisco PE router must be configured to ignore or drop all packets with any IP options.
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Packets with IP options are not fast-switched and therefore must be punted to the router processor. Hackers who initiate denial of service (DoS) attacks on routers commonly send large streams of packets with IP options. Dropping the packets with IP options reduces the load of IP options packets on the router. The end result is a reduction in the effects of the DoS attack on the router and on downstream routers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to ignore or drop all packets with IP options as shown in the examples below:

  R4(config)#ip options ignore 

  or

  R4(config)#ip options drop

check_text:
  Review the router configuration to determine if it will ignore or drop all packets with IP options as shown in the examples below:

  ip options drop
  or
  ip options ignore

  If the router is not configured to drop or block all packets with IP options, this is a finding.


vuln_id: V-229031
rule_id: SV-229031r878127_rule
severity: CAT II
title: The Cisco router must be configured to have Cisco Express Forwarding enabled.
fix_text:
  Enable CEF

  IPv4 Example: ip cef
  IPv6 Example: ipv6 cef

cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Cisco Express Forwarding (CEF) switching mode replaces the traditional Cisco routing cache with a data structure that mirrors the entire system routing table. Because there is no need to build cache entries when traffic starts arriving for new destinations, CEF behaves more predictably when presented with large volumes of traffic addressed to many destinations—such as SYN flood attacks. Because many SYN flood attacks use randomized source addresses to which the hosts under attack will reply to, there can be a substantial amount of traffic for a large number of destinations that the router will have to handle. Consequently, routers configured for CEF will perform better under SYN floods directed at hosts inside the network than routers using the traditional cache.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the router to verify that CEF is enabled.

  IPv4 Example: ip cef 
  IPv6 Example: ipv6 cef

  If CEF is not enabled, this is a finding.


vuln_id: V-230039
rule_id: SV-230039r647454_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

description:
  <VulnDiscussion>The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached its destination.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to advertise a hop limit of at least 32 in Router Advertisement messages.

  R1(config)#ipv6 hop-limit 128

check_text:
  Review the router configuration to determine if the hop limit has been configured for Router Advertisement messages as shown in the example.

  ipv6 hop-limit 128

  If it has been configured and has not been set to at least 32, it is a finding.


vuln_id: V-230042
rule_id: SV-230042r647455_rule
severity: CAT II
title: The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.
fix_text: Configure the router using only authorized IPv6 addresses.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity, and potential misrouting as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix FEC0::/10 as defined in RFC3513.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the router configuration to ensure FEC0::/10 IPv6 addresses are not defined. 

  If IPv6 Site Local Unicast addresses are defined, this is a finding.


vuln_id: V-230045
rule_id: SV-230045r647430_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

description:
  <VulnDiscussion>Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. To mitigate these vulnerabilities, links that have no hosts connected such as the interface connecting to external gateways must be configured to suppress router advertisements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to suppress Router Advertisements on all external IPv6-enabled interfaces as shown in the example below.
  R1(config)#int g1/0
  R1(config-if)#ipv6 nd ra suppress
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DoDIN Backbone. 

  Review the router configuration to verify that Router Advertisements are suppressed on all external IPv6-enabled interfaces as shown in the example below.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 nd ra suppress

  If the router is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.


vuln_id: V-230048
rule_id: SV-230048r950991_rule
severity: CAT II
title: The Cisco perimeter router must be configured to drop IPv6 undetermined transport packets.
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This packet contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to drop IPv6 undetermined transport packets as shown in the example below.
  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny ipv6 any any undetermined-transport log
  R1(config-ipv6-acl)#permit ipv6 …
  …
  …
  …
  R1(config-ipv6-acl)#deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6 in

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration to determine if it is configured to drop IPv6 undetermined transport packets.

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops undetermined transport packets as shown in the example below.

  ipv6 access-list FILTER_IPV6
   deny ipv6 any any log undetermined-transport
   permit ipv6 …
   …
   …
   …
   deny ipv6 any any log

  If the router is not configured to drop IPv6 undetermined transport packets, this is a finding.


vuln_id: V-230051
rule_id: SV-230051r855846_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3–255.

description:
  <VulnDiscussion>The routing header can be used maliciously to send a packet through a path where less robust security is in place, rather than through the presumably preferred path of routing protocols. Use of the routing extension header has few legitimate uses other than as implemented by Mobile IPv6. 

  The Type 0 Routing Header (RFC 5095) is dangerous because it allows attackers to spoof source addresses and obtain traffic in response, rather than the real owner of the address. Secondly, a packet with an allowed destination address could be sent through a Firewall using the Routing Header functionality, only to bounce to a different node once inside. The Type 1 Routing Header is defined by a specification called "Nimrod Routing", a discontinued project funded by DARPA. Assuming that most implementations will not recognize the Type 1 Routing Header, it must be dropped. The Type 3–255 Routing Header values in the routing type field are currently undefined and should be dropped inbound and outbound.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to drop IPv6 packets with Routing Header of type 0, 1, or 3-255 as shown in the example below.
  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#permit ipv6 any host 2001:DB8::0:1:1:1234 routing-type 2
  R1(config-ipv6-acl)#deny ipv6 any any routing log
  R1(config-ipv6-acl)#permit …
  …
  …
  …
  R1(config-ipv6-acl)#deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration to determine if it is configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255.

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets with a Routing Header type 0, 1, or 3-255 as shown in the example below.

  ipv6 access-list FILTER_IPV6
   permit ipv6 any host 2001:DB8::1:1:1234 routing-type 2
   deny ipv6 any any log routing
   permit ipv6 …
   …
   …
   …
  deny ipv6 any any log

  Note: The example above allows routing-type 2 in the event Mobility IPv6 is deployed.

  If the router is not configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255, this is a finding.


vuln_id: V-230146
rule_id: SV-230146r855847_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.

description:
  <VulnDiscussion>These options are intended to be for the Destination Options header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize and hence could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Drop IPv6 packets containing a Hop-by-Hop header as shown in the example below.

  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny hbh any any dest-option-type 4 log
  R1(config-ipv6-acl)#deny hbh any any dest-option-type 195 log
  R1(config-ipv6-acl)#deny hbh any any dest-option-type home-address log
  R1(config-ipv6-acl)# permit ipv6 …
  …
  …
  …
  R1(config-ipv6-acl)#deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration to determine if it is compliant with this requirement.  

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop header with option type values of 0x04 (Tunnel Encapsulation Limit), 0xC9 (Home Address Destination), or 0xC3 (NSAP Address) as shown in the example below.
  ipv6 access-list FILTER_IPV6
   deny hbh any any dest-option-type 4 log
   deny hbh any any dest-option-type 195 log
   deny hbh any any dest-option-type home-address log 
   permit ipv6 …
   …
   …
   …
   deny ipv6 any any log

  If the router is not configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values, this is a finding.


vuln_id: V-230150
rule_id: SV-230150r855848_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.

description:
  <VulnDiscussion>These options are intended to be for the Hop-by-Hop header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize. Hence, this could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to drop IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below.
  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny 60 any any dest-option-type 5 log
  R1(config-ipv6-acl)#deny 60 any any dest-option-type 194 log
  R1(config-ipv6-acl)#permit …
  …
  …
  …
  R1(config-ipv6-acl)#deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration to determine if it is compliant with this requirement.  

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below.

  ipv6 access-list FILTER_IPV6
   deny 60 any any dest-option-type 5 log
   deny 60 any any dest-option-type 194 log
   permit ipv6 …
   …
   …
   …
   deny ipv6 any any log

  If the router is not configured to drop IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload), this is a finding.


vuln_id: V-230153
rule_id: SV-230153r855849_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.

description:
  <VulnDiscussion>The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. This option type is associated with the Nimrod Routing system and has no defining RFC document.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to drop IPv6 packets containing an option type values of 0x8A (Endpoint Identification) regardless of whether it appears in a Hop-by-Hop or Destination Option header as shown in the example below.

  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny any any dest-option-type 138 log
  R1(config-ipv6-acl)#permit ipv6 …
  …
  …
  …
  R1(config-ipv6-acl)# deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration to determine if it is compliant with this requirement.  

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets containing an extension header with the Endpoint Identification option as shown in the example below.

  ipv6 access-list FILTER_IPV6
   deny any any dest-option-type 138 log
   permit ipv6 …
   …
   …
   …
   deny ipv6 any any log

  If the router is not configured to drop IPv6 packets containing an extension header with the Endpoint Identification option, this is a finding.


vuln_id: V-230156
rule_id: SV-230156r855850_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.

description:
  <VulnDiscussion>The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. This option type from RFC 1888 (OSI NSAPs and IPv6) has been deprecated by RFC 4048.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to to drop IPv6 packets containing the NSAP address option within Destination Option header as shown in the example below.

  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny 60 any any dest-option-type 195 log
  R1(config-ipv6-acl)#permit …
  …
  …
  …
  R1(config-ipv6-acl)# deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration and determine if filters are bound to the applicable interfaces to drop IPv6 packets containing a Destination Option header with option type value of 0xC3 (NSAP address). 

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets containing the NSAP address option within Destination Option header as shown in the example below.

  ipv6 access-list FILTER_IPV6
   deny 60 any any dest-option-type 195 log
   permit ipv6 …
   …
   …
   …
   deny ipv6 any any log

  If the router is not configured to drop IPv6 packets containing the NSAP address option within Destination Option header, this is a finding.


vuln_id: V-230159
rule_id: SV-230159r855851_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.

description:
  <VulnDiscussion>The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to drop all inbound IPv6 packets containing an undefined option type value regardless of whether they appear in a Hop-by-Hop or Destination Option header as shown in the example below.

  R1(config)#ipv6 access-list FILTER_IPV6
  R1(config-ipv6-acl)#deny any any dest-option-type 2
  R1(config-ipv6-acl)#deny any any dest-option-type 3
  R1(config-ipv6-acl)#deny any any dest-option-type 6
  R1(config-ipv6-acl)#deny any any dest-option-type 9
  R1(config-ipv6-acl)#deny any any dest-option-type 10
  R1(config-ipv6-acl)#deny any any dest-option-type 11
  R1(config-ipv6-acl)#deny any any dest-option-type 12
  R1(config-ipv6-acl)#deny any any dest-option-type 13
  R1(config-ipv6-acl)#deny any any dest-option-type 14
  R1(config-ipv6-acl)#deny any any dest-option-type 16
   …
  R1(config-ipv6-acl)#deny any any dest-option-type 34
  R1(config-ipv6-acl)#deny any any dest-option-type 36
  R1(config-ipv6-acl)#deny any any dest-option-type 37
  R1(config-ipv6-acl)#deny any any dest-option-type 39
  …
  R1(config-ipv6-acl)#deny any any dest-option-type 47
  R1(config-ipv6-acl)#deny any any dest-option-type 49
  … 
  R1(config-ipv6-acl)#deny any any dest-option-type 255
  R1(config-ipv6-acl)#permit …
  …
  …
  …
  R1(config-ipv6-acl)#deny ipv6 any any log
  R1(config-ipv6-acl)#exit
  R1(config)#int g1/0
  R1(config-if)#ipv6 traffic-filter FILTER_IPV6

check_text:
  This requirement is not applicable for the DODIN Backbone. 

  Review the router configuration and determine if filters are bound to the applicable interfaces to drop all inbound IPv6 packets containing an undefined option type value regardless of whether they appear in a Hop-by-Hop or Destination Option header. Undefined values are 0x02, 0x03, 0x06, 0x9 – 0xE, 0x10 – 0x22, 0x24, 0x25, 0x27 – 0x2F, and 0x31 – 0xFF.

  Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

  interface gigabitethernet1/0
   ipv6 address 2001::1:0:22/64
   ipv6 traffic-filter FILTER_IPV6 in

  Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type as shown in the example below.

  ipv6 access-list FILTER_IPV6
   deny any any dest-option-type 2
   deny any any dest-option-type 3
   deny any any dest-option-type 6
   deny any any dest-option-type 9
   deny any any dest-option-type 10
   deny any any dest-option-type 11
   deny any any dest-option-type 12
   deny any any dest-option-type 13
   deny any any dest-option-type 14
   deny any any dest-option-type 16
    …
   deny any any dest-option-type 34
   deny any any dest-option-type 36
   deny any any dest-option-type 37
   deny any any dest-option-type 39
   …
   deny any any dest-option-type 47
   deny any any dest-option-type 49
   … 
   deny any any dest-option-type 255
   permit  …
   …
   …
   …
   deny ipv6 any any log

  Note: Because hop-by-hop and destination options have the same exact header format, they can be combined under the dest-option-type keyword. Since Hop-by-Hop and Destination Option headers have non-overlapping types, you can use dest-option-type to match either.

  If the router is not configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type, this is a finding.


vuln_id: V-251545
rule_id: SV-251545r961683_rule
severity: CAT I
title: The installed version of Firefox must be supported.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Using versions of an application that are not supported by the vendor is not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported versions, which can leave the application vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Upgrade the version of the browser to an approved version by obtaining software from the vendor or other trusted source.

check_text:
  Run Firefox. Click the ellipsis button >> Help >> About Firefox, and view the version number.

  If the Firefox version is not a supported version, this is a finding.


vuln_id: V-251546
rule_id: SV-251546r961869_rule
severity: CAT I
title: Firefox must be configured to allow only TLS 1.2 or above.
cci: CCI-001453
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Use of versions prior to TLS 1.2 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Minimum SSL version enabled
  Policy State: Enabled
  Policy Value: TLS 1.2   (or TLS 1.3)

  macOS "plist" file:
  Add the following:
  <key>SSLVersionMin</key>
  <string>tls1.2</string>   (or <string>tls1.3</string>)

  Linux "policies.json" file:
  Add the following in the policies section:
  "SSLVersionMin": "tls1.2"   or ("SSLVersionMin": "tls1.3")

check_text:
  Type "about:policies" in the browser window. 

  If "SSLVersionMin" is not displayed under Policy Name or the Policy Value is not "tls1.2" or "tls1.3", this is a finding.


vuln_id: V-251547
rule_id: SV-251547r1067550_rule
severity: CAT II
cci: CCI-000187
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Firefox must be configured to ask which certificate to present to a website when a certificate is required.

description:
  <VulnDiscussion>When a website asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access, which increases security for DOD information. Access will be denied to the user if certificate management is not configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "security.default_personal_cert": {
      "Value": "Ask Every Time",
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>security.default_personal_cert</key>
    <dict>
      <key>Value</key>
      <string>Ask Every Time</string>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
    "security.default_personal_cert": {
      "Value": "Ask Every Time",
      "Status": "locked"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name and the Policy Value does not include "security.default_personal_cert" with a value of "Ask Every Time" and status of "locked", this is a finding.


vuln_id: V-251548
rule_id: SV-251548r1067552_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Firefox must be configured to not automatically check for updated versions of installed search plugins.

description:
  <VulnDiscussion>Updates must be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings that may direct the application to access external URLs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "browser.search.update": {
      "Value": false,
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>browser.search.update</key>
    <dict>
      <key>Value</key>
      <false/>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
    "browser.search.update": {
      "Value": false,
      "Status": "locked"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name or the Policy Value does not include "browser.search.update" with a value of  "false" and status of "locked", this is a finding.


vuln_id: V-251549
rule_id: SV-251549r960963_rule
severity: CAT II
title: Firefox must be configured to not automatically update installed add-ons and plugins.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Extensions
  Policy Name: Extension Update
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>ExtensionUpdate</key>
  <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "ExtensionUpdate": false

check_text:
  Type "about:policies" in the browser window.

  If "ExtensionUpdate" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.


vuln_id: V-251550
rule_id: SV-251550r961194_rule
severity: CAT II
fix_text: Remove any unauthorized extensions from the auto-download list.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Firefox must be configured to not automatically execute or download MIME types that are not authorized for auto-download.

description:
  <VulnDiscussion>Some files can be downloaded or execute without user interaction. This setting ensures these files are not downloaded and executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Type "about:preferences" in the browser address bar. 

  Type "Applications" in the Find bar in the upper-right corner. 

  Determine if any of the following file extensions are listed: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, DOS, BAT, PS, EPS, WCH, WCM, WB1, WB3, WCH, WCM, AD.

  If the entry exists and the "Action" is "Save File" or "Always Ask", this is not a finding.
   
  If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, this is a finding.


vuln_id: V-251551
rule_id: SV-251551r960963_rule
severity: CAT II
title: Firefox must be configured to disable form fill assistance.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>To protect privacy and sensitive data, Firefox provides the ability to configure the program so that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Form History
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisableFormHistory</key>
  <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableFormHistory": true

check_text:
  Type "about:policies" in the browser window. 

  If "DisableFormHistory" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251552
rule_id: SV-251552r960963_rule
severity: CAT II
title: Firefox must be configured to not use a password store with or without a master password.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate PIN, which could lead to compromise of DoD information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: PasswordManager
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>PasswordManagerEnabled</key>
  <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "PasswordManagerEnabled": false

check_text:
  Type "about:policies" in the browser window. 

  If "PasswordManagerEnabled" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.


vuln_id: V-251553
rule_id: SV-251553r960963_rule
severity: CAT II
title: Firefox must be configured to block pop-up windows.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Pop-up windows may be used to launch an attack within a new browser window with altered settings. This setting blocks pop-up windows created while the page is loading.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Popups
  Policy Name: Block pop-ups from websites
  Policy State: Enabled

  Policy Name: Do not allow preferences to be changed
  Policy State: Enabled

  Optional:
  Policy Name: Allowed Sites
  Policy State: Enabled
  Click "Show..." and enter a list of websites to be allowlisted.

  macOS "plist" file:
  Add the following:
  <key>PopupBlocking</key>
    <dict>
      <key>Allow</key>
      <array>
        <string>http://example.mil</string>
        <string>http://example.gov</string>
      </array>
      <key>Default</key>
      <true/>
      <key>Locked</key>
      <true/>
    </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "PopupBlocking": {
        "Allow": ["http://example.mil/",
                  "http://example.gov/"],
        "Default": true,
        "Locked": true}

check_text:
  Type "about:policies" in the browser address bar.

  If "PopupBlocking" is not displayed under Policy Name or the Policy Value is not "Default" "true", this is a finding.
  If "PopupBlocking" is not displayed under Policy Name or the Policy Value is not "Locked" "true", this is a finding.

  "PopupBlocking" "Enabled" may be used to specify an allowlist of sites where pop-ups are desired, this is optional.


vuln_id: V-251554
rule_id: SV-251554r1067554_rule
severity: CAT II
title: Firefox must be configured to prevent JavaScript from moving or resizing windows.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>JavaScript can make changes to the browser's appearance. This activity can help disguise an attack taking place in a minimized background window. Configure the browser setting to prevent scripts on visited websites from moving and resizing browser windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "dom.disable_window_move_resize": {
      "Value": true,
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>dom.disable_window_move_resize</key>
    <dict>
      <key>Value</key>
      <true/>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
    "dom.disable_window_move_resize": {
      "Value": true,
      "Status": "locked"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name or the Policy Value does not include "dom.disable_window_move_resize" with a value of  "true" and status of "locked", this is a finding.


vuln_id: V-251555
rule_id: SV-251555r1067556_rule
severity: CAT II
title: Firefox must be configured to prevent JavaScript from raising or lowering windows.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>JavaScript can raise and lower browser windows to cause improper input. Configure the browser setting to prevent scripts on visited websites from raising and lowering browser windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "dom.disable_window_flip": {
      "Value": true,
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>dom.disable_window_flip</key>
    <dict>
      <key>Value</key>
      <true/>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
    "dom.disable_window_flip": {
      "Value": true,
      "Status": "locked"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name or the Policy Value does not include "dom.disable_window_flip" with a value of "true" and status of "locked", this is a finding.


vuln_id: V-251557
rule_id: SV-251557r960963_rule
severity: CAT II
title: Firefox must be configured to disable the installation of extensions.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A browser extension is a program that has been installed into the browser to add functionality. Where a plug-in interacts only with a web page and usually a third-party external application (e.g., Flash, Adobe Reader), an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions that apply to web pages. 

  For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed, which can be considered cross-site scripting. If a browser is configured to allow unrestricted use of extensions, plug-ins can be loaded and installed from malicious sources and used on the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Addons
  Policy Name: Allow add-on installs from websites
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>InstallAddonsPermission</key>
  <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "InstallAddonsPermission": {
        "Default": false
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "InstallAddonsPermission" is not displayed under Policy Name or the Policy Value is not "Default" "false", this is a finding.


vuln_id: V-251558
rule_id: SV-251558r960963_rule
severity: CAT II
title: Background submission of information to Mozilla must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Firefox by default sends information about Firefox to Mozilla servers. There should be no background submission of technical and other information from DoD computers to Mozilla with portions posted publicly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Telemetry
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisableTelemetry</key>
  <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableTelemetry": true

check_text:
  Type "about:policies" in the browser window. 

  If "DisableTelemetry" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251559
rule_id: SV-251559r961167_rule
severity: CAT III
title: Firefox development tools must be disabled.
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser, information about the web browser, such as web browser type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any back ends being used for data storage may be displayed. Because this information may be placed in logs and general messages during normal operation of the web browser, an attacker does not have to cause an error condition to gain this information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Developer Tools
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisableDeveloperTools</key>
  <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableDeveloperTools": true

check_text:
  Type "about:policies" in the browser window. 

  If "DisableDeveloperTools" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251560
rule_id: SV-251560r1067559_rule
severity: CAT II
title: Firefox must have the DOD root certificates installed.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The DOD root certificates will ensure that the trust chain is established for server certificates issued from the DOD Certificate Authority (CA).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the DOD root certificates. Other AO-approved certificates may also be used. Certificates designed for SIPRNet may be used as appropriate.

  On Windows, import certificates from the operating system by using Certificates >> Import Enterprise Roots (Certificates) via policy or Group Policy Object (GPO).

check_text:
  Type "about:preferences#privacy" in the browser window. 

  Scroll down to the bottom and select "View Certificates...".

  In the Certificate Manager window, select the "Authorities" tab.

  Scroll through the Certificate Name list to the U.S. Government heading. Look for the entries for DOD Root CA 3, DOD Root CA 4, and DOD Root CA 5.

  If there are entries for DOD Root CA 3, DOD Root CA 4, and DOD Root CA 5, select them individually.

  Click "View".

  Verify the issuer name is "US Government".

  If there are no entries for the appropriate DOD root certificates, this is a finding. If other AO-approved certificates are used, this is not a finding. If SIPRNet-specific certificates are used, this is not a finding.

  Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store. This is not a finding. It can also be set via the policy Certificates >> ImportEnterpriseRoots, which can be verified via "about:policies".


vuln_id: V-251562
rule_id: SV-251562r987660_rule
severity: CAT II
title: Firefox must prevent the user from quickly deleting data.
cci: CCI-002355
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>There should not be an option for a user to "forget" work they have done. This is required to meet non-repudiation controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Forget Button
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisableForgetButton</key>
  <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableForgetButton": true

check_text:
  Type "about:policies" in the browser address bar. 

  If "DisableForgetButton" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251563
rule_id: SV-251563r960963_rule
severity: CAT II
title: Firefox private browsing must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Private browsing allows the user to browse the internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Private Browsing
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisablePrivateBrowsing</key>
  <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisablePrivateBrowsing": true

check_text:
  Type "about:policies" in the browser window. 

  If "DisablePrivateBrowsing" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251564
rule_id: SV-251564r960963_rule
severity: CAT II
title: Firefox search suggestions must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Search suggestions must be disabled as this could lead to searches being conducted that were never intended to be made.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Search
  Policy Name: Search Suggestions
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>SearchSuggestEnabled</key>
  <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "SearchSuggestEnabled": false

check_text:
  Type "about:policies" in the browser window.

  If "SearchSuggestEnabled" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.


vuln_id: V-251565
rule_id: SV-251565r960963_rule
severity: CAT III
title: Firefox autoplay must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Autoplay allows the user to control whether videos can play automatically (without user consent) with audio content. The user must be able to select content that is run within the browser window.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Permissions\Autoplay
  Policy Name: Default autoplay level
  Policy State: Enabled
  Policy Value: Block Audio and Video

  macOS "plist" file:
  Add the following:
  <key>Permissions</key>
  <dict>
    <key>Autoplay</key>
    <dict>
      <string>block-audio-video</string>
    </dict>
  </dict>
   
  Linux "policies.json" file:
  Add the following in the policies section:
  "Permissions": {
    "Autoplay": {
      "Default": "block-audio-video"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Permissions" is not displayed under Policy Name or the Policy Value is not "Autoplay" with a value of "Default" and "Block-audio-video", this is a finding.


vuln_id: V-251566
rule_id: SV-251566r960963_rule
severity: CAT II
title: Firefox network prediction must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>If network prediction is enabled, requests to URLs are made without user consent. The browser should always make a direct DNS request without prefetching occurring.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Network Prediction
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>NetworkPrediction</key>
  <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "NetworkPrediction": false

check_text:
  Type "about:policies" in the browser window. 

  If "NetworkPrediction" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.


vuln_id: V-251567
rule_id: SV-251567r960963_rule
severity: CAT II
title: Firefox fingerprinting protection must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists that Firefox is set to use, the fingerprinting script (or other tracking script/image) will not be loaded from that site.

  Fingerprinting scripts collect information about browser and device configuration, such as operating system, screen resolution, and other settings. By compiling these pieces of data, fingerprinters create a unique profile that can be used to track the user around the web.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Tracking Protection
  Policy Name: Fingerprinting
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>EnableTrackingProtection</key>
    <dict>
      <key>Fingerprinting</key>
   <true/>
    </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "EnableTrackingProtection": {
    "Fingerprinting": true
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "EnableTrackingProtection" is not displayed under Policy Name or the Policy Value is not "Fingerprinting"  with a value of "true", this is a finding.


vuln_id: V-251568
rule_id: SV-251568r960963_rule
severity: CAT II
title: Firefox cryptomining protection must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists that Firefox is set to use, the fingerprinting script (or other tracking script/image) will not be loaded from that site.

  Cryptomining scripts use a computer's central processing unit to invisibly mine cryptocurrency.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Tracking Protection
  Policy Name: Cryptomining
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>EnableTrackingProtection</key>
    <dict>
      <key>Cryptomining</key>
   <true/>
    </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "EnableTrackingProtection": {
    "Cryptomining": true
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "EnableTrackingProtection" is not displayed under Policy Name or the Policy Value is not "Cryptomining" with a value of "true", this is a finding.


vuln_id: V-251569
rule_id: SV-251569r1067561_rule
severity: CAT II
title: Firefox Enhanced Tracking Protection must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Tracking generally refers to content, cookies, or scripts that can collect browsing data across multiple sites.

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of nonessential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "browser.contentblocking.category": {
      "Value": "strict",
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>browser.contentblocking.category</key>
    <dict>
      <key>Value</key>
      <string>strict</string>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
    "browser.contentblocking.category": {
      "Value": "strict",
      "Status": "locked"
    }
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name or the Policy Value does not include "browser.contentblocking.category" with a value of  "strict" and status of "locked", this is a finding.


vuln_id: V-251570
rule_id: SV-251570r1067563_rule
severity: CAT II
title: Firefox extension recommendations must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Recommended Extensions program makes it easier for users to discover extensions that have been reviewed for security, functionality, and user experience. Allowed extensions are to be centrally managed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Preferences
  Policy State: Enabled
  Policy Value:
  {
    "extensions.htmlaboutaddons.recommendations.enabled": {
      "Value": false,
      "Status": "locked"
    }
  }

  macOS "plist" file:
  Add the following:
  <key>Preferences</key>
  <dict>
    <key>extensions.htmlaboutaddons.recommendations.enabled</key>
    <dict>
      <key>Value</key>
      <false/>
      <key>Status</key>
      <string>locked</string>
    </dict>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "Preferences": {
  "extensions.htmlaboutaddons.recommendations.enabled": {
  "Value": false,
  "Status": "locked"
  },

check_text:
  Type "about:policies" in the browser address bar. 

  If "Preferences" is not displayed under Policy Name and the Policy Value does not include "extensions.htmlaboutaddons.recommendations.enabled" with a value of  "false" and status of "locked", this is a finding.


vuln_id: V-251571
rule_id: SV-251571r960963_rule
severity: CAT II
title: Firefox deprecated ciphers must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A weak cipher is defined as an encryption/decryption algorithm that uses a key of insufficient length. Using an insufficient length for a key in an encryption/decryption algorithm opens up the possibility (or probability) that the encryption scheme could be broken.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Disabled Ciphers
  Policy Name: TLS_RSA_WITH_3DES_EDE_CBC_SHA
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>DisabledCiphers</key>
    <dict>
      <key>TLS_RSA_WITH_3DES_EDE_CBC_SHA</key>
      <true/>
    </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisabledCiphers": {
    "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true
  }

check_text:
  Type "about:policies" in the browser address bar.

  If "DisabledCiphers" is not displayed under Policy Name or the Policy Value is not "TLS_RSA_WITH_3DES_EDE_CBC_SHA" with a value of  "true", this is a finding.


vuln_id: V-251572
rule_id: SV-251572r960963_rule
severity: CAT II
title: Firefox must not recommend extensions as the user is using the browser.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Recommended Extensions program recommends extensions to users as they surf the web.

  The user must not be encouraged to install extensions from the websites they visit. Allowed extensions are to be centrally managed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\User Messaging
  Policy Name: Extension Recommendations
  Policy State: Disabled

  macOS "plist" file:
  Add the following:
  <key>UserMessaging</key>
  <dict>
    <key>ExtensionRecommendations</key>
    <false/>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "UserMessaging": {
    "ExtensionRecommendations": false
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "UserMessaging" is not displayed under Policy Name or the Policy Value is not "ExtensionRecommendations" with a value of "false", this is a finding.


vuln_id: V-251573
rule_id: SV-251573r960963_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Firefox New Tab page must not show Top Sites, Sponsored Top Sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.

description:
  <VulnDiscussion>The New Tab page by default shows a list of built-in top sites, as well as the top sites the user has visited.

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.

  The new tab page must not actively show user activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Customize Firefox Home
  Policy State: Enabled
  Policy Value: Uncheck "Search"
  Policy Value: Uncheck "Top Sites"
  Policy Value: Uncheck "Sponsored Top Sites"
  Policy Value: Uncheck "Recommended by Pocket"
  Policy Value: Uncheck "Sponsored Pocket Stories"
  Policy Value: Uncheck "Download History"
  Policy Value: Uncheck "Snippets"
  Policy Value: Check "Do not allow settings to be changed"

  macOS "plist" file:
  Add the following:
  <key>FirefoxHome</key>
  <dict>
  <key>Search</key>
    <false/>
  <key>TopSites</key>
    <false/>
  <key>SponsoredTopSites</key>
    <false/>
  <key>Pocket</key>
    <false/>
  <key>SponsoredPocket</key>
    <false/>
  <key>Highlights</key>
    <false/>
  <key>Snippets</key>
    <false/>
  <key>Locked</key>
    <true/>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "FirefoxHome": {
    "Search": false,
    "TopSites": false,
    "SponsoredTopSites": false,
    "Pocket": false,
    "SponsoredPocket": false,
    "Highlights": false,
    "Snippets": false,
    "locked": true
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Search" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "TopSites" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "SponsoredTopSites" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Pocket" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "SponsoredPocket" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Highlights" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Snippets" with a value of "false", this is a finding.
  If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Locked" with a value of "true", this is a finding.


vuln_id: V-251577
rule_id: SV-251577r960963_rule
severity: CAT II
title: Firefox must be configured so that DNS over HTTPS is disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>DNS over HTTPS has generally not been adopted in the DoD. DNS is tightly controlled.

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\DNS Over HTTPS
  Policy Name: Enabled
  Policy State: Disabled

  macOS "plist" file:
  <key>DNSOverHTTPS</key>
    <dict>
      <key>Enabled</key>
      <false/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DNSOverHTTPS": {"Enabled": false}

check_text:
  Type "about:policies" in the browser address bar. 

  If "DNSOverHTTPS" is not displayed under Policy Name or the Policy Value does not have "Enabled" with a value of "false", this is a finding.


vuln_id: V-251578
rule_id: SV-251578r960963_rule
severity: CAT II
title: Firefox accounts must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Disable Firefox Accounts integration (Sync). 

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Disable Firefox Accounts
  Policy State: Enabled

  macOS "plist" file:
  <key>DisableFirefoxAccounts</key>
    <true/> 

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableFirefoxAccounts": true

check_text:
  Type "about:policies" in the browser address bar. 

  If "DisableFirefoxAccounts" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251580
rule_id: SV-251580r960963_rule
severity: CAT II
title: Firefox feedback reporting must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site). 

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\
  Policy Name: Disable Feedback Commands
  Policy State: Enabled

  macOS "plist" file:
  <key>DisableFeedbackCommands</key>
    <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableFeedbackCommands": true

check_text:
  Type "about:policies" in the browser address bar. 

  If "DisableFeedbackCommands" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.


vuln_id: V-251581
rule_id: SV-251581r960963_rule
severity: CAT II
title: Firefox encrypted media extensions must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Enable or disable Encrypted Media Extensions and optionally lock it.

  If "Enabled" is set to "false", Firefox does not download encrypted media extensions (such as Widevine) unless the user consents to installing them.

  If "Locked" is set to "true" and "Enabled" is set to "false", Firefox will not download encrypted media extensions (such as Widevine) or ask the user to install them.

  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Encrypted Media Extensions
  Policy Name: Enable Encrypted Media Extensions
  Policy State: Disabled
  Policy Name: Lock Encrypted Media Extensions
  Policy State: Enabled

  macOS "plist" file:
  <key>EncryptedMediaExtensions</key>
    <dict>
      <key>Enabled</key>
      <false/>
      <key>Locked</key>
      <true/> 

  Linux "policies.json" file:
  Add the following in the policies section:
  "EncryptedMediaExtensions": {
    "Enabled": false,
    "Locked": true
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "EncryptedMediaExtensions" is not displayed under Policy Name or the Policy Value does not have "Enabled" set to "false" or the Policy Value does not have "Locked" set to "true", this is a finding.


vuln_id: V-252881
rule_id: SV-252881r960963_rule
severity: CAT II
title: Firefox must be configured to not delete data upon shutdown.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>For diagnostic purposes, data must remain behind when the browser is closed. This is required to meet non-repudiation controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Clear data when browser is closed
  Policy Name: Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences, Offline Website Data
  Policy State: Disabled
  Policy Name: Locked
  Policy State: Enabled

  macOS "plist" file:
  Add the following:
  <key>SanitizeOnShutdown</key>
  <dict>
    <key>Cache</key>
    <false/>
    <key>Cookies</key>
    <false/>
    <key>Downloads</key>
    <false/>
    <key>FormData</key>
    <false/>
    <key>History</key>
    <false/>
    <key>Sessions</key>
    <false/>
    <key>SiteSettings</key>
    <false/>
    <key>OfflineApps</key>
    <false/>
    <key>Locked</key>
    <true/>
  </dict>

  Linux "policies.json" file:
  Add the following in the policies section:
  "SanitizeOnShutdown": {
    "Cache": false,
    "Cookies": false,
    "Downloads": false,
    "FormData": false,
    "History": false,
    "Sessions": false,
    "SiteSettings": false,
    "OfflineApps": false,
    "Locked": true 
  }

check_text:
  Type "about:policies" in the browser address bar. 

  If "SanitizeOnShutdown" is not displayed under Policy Name or the Policy Value does not have {"Cache":false,"Cookies":false,"Downloads":false,"FormData":false,"Sessions":false,"History":false,"OfflineApps":false,"SiteSettings":false,"Locked":true}, this is a finding.


vuln_id: V-252908
rule_id: SV-252908r960963_rule
severity: CAT II
title: Pocket must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Pocket, previously known as Read It Later, is a social bookmarking service for storing, sharing, and discovering web bookmarks. Data gathering cloud services such as this are generally disabled in the DoD.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Pocket
  Policy State: Enabled

  macOS "plist" file:
  <key>DisablePocket</key>
   <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisablePocket": true

check_text:
  Type "about:policies" in the browser address bar. 

  If "DisablePocket" is not displayed under Policy Name or the Policy Value does not have a value of "true", this is a finding.


vuln_id: V-252909
rule_id: SV-252909r960963_rule
severity: CAT II
title: Firefox Studies must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Studies try out different features and ideas before they are released to all Firefox users. Testing beta software is not in the DoD user's mission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with "gpedit.msc".
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
  Policy Name: Disable Firefox Studies
  Policy State: Enabled

  macOS "plist" file:
  <key>DisableFirefoxStudies</key>
   <true/>

  Linux "policies.json" file:
  Add the following in the policies section:
  "DisableFirefoxStudies": true

check_text:
  Type "about:policies" in the browser address bar. 

  If "DisableFirefoxStudies" is not displayed under Policy Name or the Policy Value does not have a value of "true", this is a finding.


vuln_id: V-225223
rule_id: SV-225223r961038_rule
severity: CAT II
title: Digital signatures assigned to strongly named assemblies must be verified.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A strong name consists of the assembly's identity, simple text name, version number, and culture information (if provided)—plus a public key and a digital signature.  Strong names serve to identify the author of the code.  If digital signatures used to sign strong name assemblies are not verified, any self signed code can be impersonated.  This can lead to a loss of system integrity. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use regedit to remove the values stored in Windows registry key HKLM\Software\Microsoft\StrongName\Verification. There should be no assemblies or hash values listed under this registry key.

  All assemblies must require strong name verification in a production environment.

  Strong name assemblies that do not require verification in a development or test environment must have documented approvals from the IAO.

check_text:
  Use regedit to review the Windows registry key 
  HKLM\Software\Microsoft\StrongName\Verification. 
  There should be no assemblies or hash values listed under this registry key. If the StrongName\Verification key does not exist, this is not a finding.

  If there are assemblies or hash values listed in this key, each value represents a distinct application assembly that does not have the application strong name verified.  

  If any assemblies are listed as omitting strong name verification in a production environment, this is a finding.

  If any assemblies are listed as omitting strong name verification in a development or test environment and the IAO has not provided documented approvals, this is a finding.


vuln_id: V-225224
rule_id: SV-225224r961038_rule
severity: CAT II
title: The Trust Providers Software Publishing State must be set to 0x23C00.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Microsoft Windows operating systems provide a feature called Authenticode.  Authenticode technology and its underlying code signing mechanisms serve to provide a structure to identify software publishers and ensure that software applications have not been tampered with.  Authenticode technology relies on digital certificates and is based on Public Key Cryptography Standards (PKCS) #7 (encrypted key specification), PKCS #10 (certificate request formats), X.509 (certificate specification), and Secure Hash Algorithm (SHA) and MD5 hash algorithms.

  The manner in which the Authenticode technology validates a certificate and determines what is considered a valid certificate can be modified to meet the mission of the Microsoft Windows system.  Each facade of certificate validation is controlled through the bits that makeup the hexadecimal value for the Authenticode setting.  An improper setting will allow non-valid certificates to be accepted and can put the integrity of the system into jeopardy.

  The hexadecimal value of 0x23C00 will implement the following certificate enforcement policy:
  - Trust the Test Root = FALSE
  - Use expiration date on certificates = TRUE
  - Check the revocation list = TRUE
  - Offline revocation server OK (Individual) = TRUE
  - Offline revocation server OK (Commercial) = TRUE
  - Java offline revocation server OK (Individual) = TRUE
  - Java offline revocation server OK (Commercial) = TRUE
  - Invalidate version 1 signed objects = FALSE
  - Check the revocation list on Time Stamp Signer = FALSE
  - Only trust items found in the Trust DB = FALSE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This fix must be performed for each user on the system.

  Using regedit, change the hexadecimal value of the "HKEY_USER\[UNIQUE USER SID VALUE]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State" registry key to 0x23C00.

check_text:
  If the system or application being reviewed is SIPR based, this finding is NA.

  This check must be performed for each user on the system. 

  Use regedit to locate "HKEY_USER\[UNIQUE USER SID VALUE]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State".  

  If the State value for any user is not set to the hexadecimal value of 0x23C00, this is a finding.


vuln_id: V-225225
rule_id: SV-225225r961038_rule
severity: CAT II
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Developer certificates used with the .NET Publisher Membership Condition must be approved by the ISSO.

description:
  <VulnDiscussion>A .Net assembly will satisfy the Publisher Membership Condition if it is signed with a software publisher’s Authenticode X.509v3 digital certificate that can be verified by the Windows operating system as having a chain of trust that leads to a trusted root certificate stored in the user’s certificate store. The Publisher Membership Condition can be used to identify an organization, developer, vendor, or other entity as the ultimate source of the assembly, even if the code itself was obtained from a third party, such as a mirror site. Access to system resources, such as file systems or printers, may then be granted to the assembly based on the trust relationship with the identified entity.

  Certificates used to sign assemblies so the Publisher Member Condition may be applied must originate from a trusted source. Using a certificate that is not from a trusted source could potentially violate system integrity and confidentiality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Trust must be established when utilizing Publishers Membership Condition. All publisher's certificates must have documented approvals from the ISSO.

check_text:
  The infrastructure to enable Code Access Security (CAS) exists only in .NET Framework 2.x-4.x. 

  This requirement is Not Applicable (NA) for .NET Framework greater than 4.x.

  (Note: The infrastructure is deprecated and is not receiving servicing or security fixes.)

  Caspol.exe is a Microsoft tool used for working with .Net policy. Use caspol.exe to list the code groups and any publisher membership conditions.

  The location of the caspol utility is dependent upon the system architecture of the system running .Net.

  For 32 bit systems, caspol.exe is located at %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319.
   
  For 64 bit systems, caspol.exe is located at %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319.

  Example:

  cd %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319

  To check code groups for the machine, run the following command:

  caspol.exe -m -lg

  Sample Results:
  Microsoft (R) .NET Framework CasPol 4.0.30319.1
  Copyright (c) Microsoft Corporation.  All rights reserved.

  Policy change prompt is ON

  Level = Machine

  Code Groups:

  1.  All code: Nothing
     1.1.  Zone - MyComputer: FullTrust (LevelFinal)
        1.1.1.  StrongName - 002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293: FullTrust
        1.1.2.  StrongName - 00000000000000000400000000000000: FullTrust
     1.2.  Zone - Intranet: LocalIntranet
        1.2.1.  All code: Same site Web
        1.2.2.  All code: Same directory FileIO - 'Read, PathDiscovery'
     1.3.  Zone - Internet: Internet
        1.3.1.  All code: Same site Web
     1.4.  Zone - Untrusted: Nothing
     1.5.  (First Match) Zone - Trusted: Internet
        1.5.1.  All code: Same site Web
     1.6.  Publisher - 30818902818100E47B359ACC061D70C237B572FA276C9854CFABD469DFB74E77D026630BEE2A0C2F8170A823AE69FDEB65704D7FD446DEFEF1F6BA12B6ACBDB1BFA7B9B595AB9A40636467CFF7C73F198B53A9A7CF177F6E7896EBC591DD3003C5992A266C0AD9FBEE4E2A056BE7F7ED154D806F7965F83B0AED616C192C6416CFCB46FC2F5CFD0203010001: FullTrust
  Success

  Section 1.6 above indicates the presence of a publisher's key that meets the Publisher's Membership Condition and is also given full trust.

  If the Publisher Membership Condition is used on a nondefault Code Group and the use of that publisher's certificate is not documented and approved by the ISSO, this is a finding.


vuln_id: V-225226
rule_id: SV-225226r961041_rule
severity: CAT II
title: Encryption keys used for the .NET Strong Name Membership Condition must be protected.
cci: CCI-000186
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Strong Name Membership condition requires that member assemblies be defined with Strong Names. A strong name consists of the assembly's identity, simple text name, version number, and culture information (if provided) — plus a public key and a digital signature. If assemblies do not have a strong name assigned, the assembly cannot be unique and the author of the code cannot be uniquely identified. In order to create the strong name, the developer must use a cryptographic key pair to sign the assembly. If the developer does not protect the key, the key can be stolen and used to sign any application, including malware applications. This could adversely affect application integrity and confidentiality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ask the Systems Programmer how the private keys used to sign the assembly are protected.

  Private keys are simply values stored as strings of data. Keys can be stored in files on the file system or in a centralized data repository. 

  Adequate protection methods include, but are not limited to:
  - utilizing centralized key management;
  - using strict file permissions to limit access; and
  - tying strong pass phrases to the key.

  The private key(s) used to sign the assembly must be protected. Utilize centralized key management or strict file permissions along with strong pass phrases and/or other well-established industry practices for managing and controlling access to private keys.

check_text:
  If the application is a COTS product, this requirement is Not Applicable (NA).

  The infrastructure to enable Code Access Security (CAS) exists only in .NET Framework 2.x-4.x.

  The requirement is Not Applicable (NA) for .NET Framework greater than 4.x.

  (Note: The infrastructure is deprecated and is not receiving servicing or security fixes.)

  Caspol.exe is a Microsoft tool used for working with .Net policy. Use caspol.exe to list the code groups and any publisher membership conditions.

  The location of the caspol utility is dependent upon the system architecture of the system running .Net.

  For 32 bit systems, caspol.exe is located at %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319.
   
  For 64 bit systems, caspol.exe is located at %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319.

  Example:

  cd %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319

  To check code groups, run the following command:

  caspol.exe -all -lg

  Sample response:
  Microsoft (R) .NET Framework CasPol 4.0.30319.1

  Security is ON
  Execution checking is ON
  Policy change prompt is ON

  Level = Machine

  Code Groups:

  1.  All code: Nothing
     1.1.  Zone - MyComputer: FullTrust (LevelFinal)
        1.1.1.  StrongName - 002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293: FullTrust
        1.1.2.  StrongName - 00000000000000000400000000000000: FullTrust
     1.2.  Zone - Intranet: LocalIntranet
        1.2.1.  All code: Same site Web
        1.2.2.  All code: Same directory FileIO - 'Read, PathDiscovery'
     1.3.  Zone - Internet: Internet
        1.3.1.  All code: Same site Web
     1.4.  Zone - Untrusted: Nothing
     1.5.  (First Match) Zone - Trusted: Internet
        1.5.1.  All code: Same site Web
     1.6.  Publisher - 30818902818100E47B359ACC061D70C237B572FA276C9854CFABD469DFB74E77D026630BEE2A0C2F8170A823AE69FDEB65704D7FD446DEFEF1F6BA12B6ACBDB1BFA7B9B595AB9A40636467CFF7C73F198B53A9A7CF177F6E7896EBC591DD3003C5992A266C0AD9FBEE4E2A056BE7F7ED154D806F7965F83B0AED616C192C6416CFCB46FC2F5CFD0203010001: FullTrust
  Success

  An assembly will satisfy the StrongNameMembershipCondition if its metadata contains the strongly identifying data associated with the specified strong name. At the least, this means it has been digitally signed with the private key associated with the public key recorded in the policy.

  The presence of the encryption key values in the StrongName field indicates the use of StrongNameMembershipCondition. 

  If a Strong Name Membership Condition is assigned to a non-default Code Group the private key must be adequately protected by the software developer or the entity responsible for signing the assemblies. 

  Ask the Systems Programmer how the private keys are protected. 

  Private keys are simply values stored as strings of data.  Keys can be stored in files on the file system or in a centralized data repository. 

  Adequate protection methods include, but are not limited to:
  - utilizing centralized key management;
  - using strict file permissions to limit access; and
  - tying strong pass phrases to the key.

  If the private key used to sign the assembly is not adequately protected, this is a finding.


vuln_id: V-225227
rule_id: SV-225227r960936_rule
severity: CAT II
title: CAS and policy configuration files must be backed up.
cci: CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A successful disaster recovery plan requires that CAS policy and CAS policy configuration files are identified and included in systems disaster backup and recovery events. Documentation regarding the location of system and application specific CAS policy configuration files and the frequency in which backups occur is required. If these files are not identified and the information is not documented, there is the potential that critical application configuration files may not be included in disaster recovery events which could lead to an availability risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All CAS policy and policy configuration files must be included in the system backup. 

  All CAS policy and policy configuration files must be backed up prior to migration, deployment, and reconfiguration.

  CAS policy configuration files must be included in disaster recovery plan documentation.

check_text:
  The infrastructure to enable Code Access Security (CAS) exists only in .NET Framework 2.x-4.x.

  The requirement is Not Applicable (NA) for .NET Framework greater than 4.x.

  (Note: The infrastructure is deprecated and is not receiving servicing or security fixes.)

  Ask the System Administrator if all CAS policy and policy configuration files are included in the system backup. If they are not, this is a finding.

  Ask the System Administrator if the policy and configuration files are backed up prior to migration, deployment, and reconfiguration. If they are not, this is a finding.

  Ask the System Administrator for documentation that shows CAS Policy configuration files are backed up as part of a disaster recovery plan. If they have no documentation proving the files are backed up, this is a finding.


vuln_id: V-225228
rule_id: SV-225228r1043178_rule
severity: CAT II
title: Remoting Services HTTP channels must utilize authentication and encryption.
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Note: Microsoft recommends using the Windows Communication Framework (WCF) rather than using .Net remoting. New development projects should refrain from using .Net remoting capabilities whenever possible.

  .NET remoting provides the capability to build widely distributed applications. The application components may reside all on one computer or they may be spread out across the enclave. .NET client applications can make remoting calls to use objects in other processes on the same computer or on any other computer that is reachable over the network. .NET remoting can also be used to communicate with other application domains within the same process. Remoting is achieved via the exposure of endpoints that can be used to establish remote connectivity.

  Normally when application code attempts to access a protected resource, a stack walk is performed to ensure that all stack frames have permission to access the resource. However, with .Net 4.0, when a call is made on a remote object, this stack walk is not performed across the remoting boundary. The .Net remoting infrastructure requires FullTrust permission to execute on either the client or the server. 

  Due to the fact that FullTrust permission is required, Remoting endpoints should be authenticated and encrypted in order to protect the system and the data. 

  Microsoft provides three different "channels" that are used for remoting. They are HTTP, TCP, and IPC.

  Any unauthorized use of a remoting application provides unauthorized access with FullTrust permissions to the system. This can potentially result in a loss of system integrity or confidentiality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If .NET remoting with HTTP channel is not used, this fix is Not Applicable.

  Ensure encryption and message integrity are used for HTTP remoting channels.

  The HTTP channel only supports encryption and message integrity when the remote object is hosted in Internet Information Services (IIS) using TLS.

  HTTP channels are protected via TLS (HTTPS). 
  <channels> 
     <channel ref=“http server” port=“443”/> 
  </channels> 

  Change the channel ref parameter to utilize a TLS port and leverage TLS on the remote IIS server.

check_text:
  If .NET remoting with HTTP channel is not used, this check is Not Applicable.

  Review the machine.config file and the [application name].exe.config file.

  For 32-bit systems, the "machine.config" file is contained in the following folder: %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config 

  For 64-bit systems, the "machine.config" file is contained in the following folder: %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config.

  Microsoft specifies locating the [application].config file in the same folder as the application executable (.exe) file. However, the developer does have the capability to specify a different location when the application is compiled.  Therefore, if the file is not found in the application home folder, a search of the system is required. If the [application name].exe.config file is not found on the system, then only a check of the machine.config file is required.

  Sample machine/application config file:

  <application name=“remoteserver”> 
    <service> 
      <activated type=“sample.my.object, myobjects”/> 
    </service> 
    <channels> 
      <channel ref=“http server” port=“80”/> 
    </channels> 
  </application>

  <serverProviders>
    <provider ref="wsdl" />
    <formatter ref="soap" typeFilterLevel="Low" /> 
    <formatter ref="binary" typeFilterLevel="Low" /> 
  </serverProviders> 

  Microsoft provides three "channels" that are used for remoting connectivity. They are the HTTP, TCP, and IPC channels. The channel that is used is specified via the <channels> element in the config file.  

  HTTP channel example:
  <channel ref=“http server” port=“80”/> 

  The HTTP channel only supports encryption and message integrity when the remote object is hosted in Internet Information Services (IIS) using TLS.

  The above example shows the well-known TLS port of 443 is not being used. 

  If the HTTP remoting channel is not configured to protect the channel by using TLS encryption, this is a finding.


vuln_id: V-225229
rule_id: SV-225229r1107247_rule
severity: CAT II
title: .Net Framework versions installed on the system must be supported.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unsupported software introduces risks and violates DOD policy. Applications utilizing unsupported versions of .NET introduce substantial risk to the host, network, and the enclave because they leverage an architecture that is no longer updated by the vendor. This introduces potential application integrity, availability, or confidentiality issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove unsupported versions of the .NET Framework and upgrade legacy applications that utilize unsupported versions of the .NET framework.

check_text:
  Determine which versions of the .NET Framework are installed by opening the directory %systemroot%\Microsoft.NET.

  The folder named "%systemroot%\Microsoft.NET\Framework" contains .NET files for 32 bit systems. The folder named "%systemroot%\Microsoft.NET\Framework64" contains .NET files for 64 bit systems. 64 bit systems will have both the 32 bit and the 64 bit folders. 32 bit systems do not have a Framework64 folder.

  Within each of the folders are the individual folder names that contain the corresponding versions of the .NET Framework:

  v4.0.30319
  v3.5
  v3.0
  v2.0.50727
  v1.1.4322
  v1.0.3705

  Search for all the Mscorlib.dll files in the %systemroot%\Microsoft.NET\Framework folder and the %systemroot%\Microsoft.NET\Framework64 folder if the folder exists. Click on each of the files, view properties, and click the version tab to determine the version installed. If there is no Mscorlib.dll, there is no installed version of .Net Framework in that directory.

  More specific information on determining versions of .Net Framework installed can be found at the following link. http://support.microsoft.com/kb/318785

  Verify extended support is available for the installed versions of .Net Framework.

  Verify the .Net Framework support dates with Microsoft Product Lifecycle Search link.
  http://support.microsoft.com/lifecycle/search/?sort=PN&alpha=.NET+Framework

  Beginning with .NET 3.5 SP1, the .NET Framework is considered a Component of the Windows OS. Components follow the Support Lifecycle policy of their parent product or platform.

   .NET Framework 3.5 cannot function without the .NET Framework 2.0 and the .NET Framework 3.0, because there is no common language runtime (CLR) in the .NET Framework 3.5 layer. Therefore, when the .NET Framework 3.5 product is installed, the .NET Framework 2.0 and the .NET Framework 3.0 SP products are also installed. Installation of .NET 2.0 and 3.0 SP products as part of .NET Framework 3.5 is Not a Finding. (https://support.microsoft.com/en-us/topic/clarification-on-the-support-life-cycle-for-the-net-framework-3-5-the-net-framework-3-0-and-the-net-framework-2-0-28621c7b-226c-7682-27f5-2e2a42db39c3)
   
  If any versions of the .Net Framework are installed and support is no longer available, this is a finding.


vuln_id: V-225230
rule_id: SV-225230r961908_rule
severity: CAT II
title: The .NET CLR must be configured to use FIPS approved encryption modules.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>FIPS encryption is configured via .NET configuration files.  There are numerous configuration files that affect different aspects of .Net behavior.  The .NET config files are described below.
   
  Machine Configuration Files:
  The machine configuration file, Machine.config, contains settings that apply to an entire computer. This file is located in the %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config directory for 32 bit .NET 4 installations and %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config for 64 bit systems.   Machine.config contains configuration settings for machine-wide assembly binding, built-in remoting channels, and ASP.NET.

  Application Configuration Files:
  Application configuration files contain settings specific to an application. If checking these files, a .NET review of a specific .NET application is most likely being conducted. These files contain configuration settings that the Common Language Runtime reads (such as assembly binding policy, remoting objects, and so on), and settings that the application can read. 

  The name and location of the application configuration file depends on the application's host, which can be one of the following: 

  Executable–hosted application configuration files. 

  The configuration file for an application hosted by the executable host is in the same directory as the application. The name of the configuration file is the name of the application with a .config extension. For example, an application called myApp.exe can be associated with a configuration file called myApp.exe.config. 

  Internet Explorer-hosted application configuration files. 

  If an application hosted in Internet Explorer has a configuration file, the location of this file is specified in a <link> tag with the following syntax.

  <link rel="ConfigurationFileName" href="location">

  In this tag, "location" represents a URL that point to the configuration file. This sets the application base. The configuration file must be located on the same web site as the application. 

  .NET 4.0 allows the CLR runtime to be configured to ignore FIPS encryption requirements.  If the CLR is not configured to use FIPS encryption modules, insecure encryption modules might be employed which could introduce an application confidentiality or integrity issue.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Examine the .NET CLR configuration files to find the runtime element and then the "enforceFIPSPolicy" element.

  Example:
  <configuration> 
    <runtime> 
                  <enforceFIPSPolicy enabled="true|false" />
    </runtime>
  </configuration>

  Delete the "enforceFIPSPolicy" runtime element, change the setting to "true" or there must be documented IAO approvals for the FIPS setting.

check_text:
  Examine the .NET CLR configuration files from the vulnerability discussion to find the runtime element and then the "enforceFIPSPolicy" element.

  Example:
  <configuration> 
    <runtime> 
                  <enforceFIPSPolicy enabled="true|false" />
    </runtime>
  </configuration>

  By default, the .NET "enforceFIPSPolicy" element is set to "true".

  If the "enforceFIPSPolicy" element does not exist within the "runtime" element of the CLR configuration, this is not a finding.

  If the "enforceFIPSPolicy" element exists and is set to "false", and the IAO has not accepted the risk and documented the risk acceptance, this is a finding.


vuln_id: V-225231
rule_id: SV-225231r961038_rule
severity: CAT II
title: .NET must be configured to validate strong names on full-trust assemblies.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The "bypassTrustedAppStrongNames" setting specifies whether the bypass feature that avoids validating strong names for full-trust assemblies is enabled. By default the bypass feature is enabled in .Net 4, therefore strong names are not validated for correctness when the assembly/program is loaded. Not validating strong names provides a faster application load time but at the expense of performing certificate validation. 

  Full trust assemblies are .Net applications launched from the local host. Strong names are digital signatures tied to .Net applications/assemblies.  .Net 4 considers applications installed locally to be fully trusted by default and grants these applications full permissions to access host resources. 

  The bypass feature applies to any assembly signed with a strong name and having the following characteristics:

      Fully trusted without the StrongName evidence (for example, has MyComputer zone evidence).

      Loaded into a fully trusted AppDomain.

      Loaded from a location under the ApplicationBase property of that AppDomain.

      Not delay-signed.

  Not validating the certificates used to sign strong name assemblies will provide a faster application load time, but falsely assumes that signatures used to sign the application are to be implicitly trusted.  Not validating strong name certificates introduces an integrity risk to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For 32 bit production systems: 
  Set “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AllowStrongNameBypass" to a “DWORD” value of “0”.
  On 64-bit production systems:
  Set “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\ AllowStrongNameBypass” and “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\ AllowStrongNameBypass” to a “DWORD” value of “0”.
  Or, obtain documented ISSO risk acceptance for each .Net application installed on the system. 

  Approval documentation will include complete list of all installed .Net applications, application versions, and acknowledgement of ISSO trust of each installed application.

check_text:
  If there is documented ISSO risk acceptance for development systems, this is not a finding.
  For 32 bit production systems: 
  Use regedit to examine the “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework” key.  
  On 64-bit production systems:
  Use regedit to examine both the “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework” and “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework” keys.
  If the "AllowStrongNameBypass" value does not exist, or if the “DWORD” value is set to “1”, this is a finding.

  Documentation must include a complete list of installed .Net applications, application versions, and acknowledgement that ISSO trusts each installed application.

  If application versions installed on the system do not match approval documentation, this is a finding.


vuln_id: V-225232
rule_id: SV-225232r1050651_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  .Net applications that invoke NetFx40_LegacySecurityPolicy must apply previous versions of .NET STIG guidance.

description:
  <VulnDiscussion>CAS policy is .NET runtime version-specific.  In .NET Framework version 4, CAS policy is disabled by default however; it can be re-enabled by using the NetFx40_LegacySecurityPolicy setting on a per application basis. Caspol.exe is provided by Microsoft to set security policy on .Net applications prior to version 4.0. This requirement does not apply to the caspol.exe assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB).

  When invoking the NetFx40_LegacySecurityPolicy setting in .NET 4, earlier versions of the .NET Framework CAS policy will become active therefore previous .NET STIG guidance that applies to the reactivated versions must also be applied. 

  Failure to apply applicable versions of STIG guidance can result in the loss of system confidentiality, integrity or availability.  </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The infrastructure to enable CAS exists only in .NET Framework 2.x - 4.x.

  The requirement is Not Applicable (NA) for .NET Framework > 4.x.

  (Note: The infrastructure is deprecated and is not receiving servicing or security fixes.)

  Apply the .NET Framework Security Checklist for .Net versions 1 through 3.5 when using the NetFx40_LegacySecurityPolicy setting.

check_text:
  The infrastructure to enable Code Access Security (CAS) exists only in .NET Framework 2.x - 4.x.

  The requirement is Not Applicable (NA) for .NET Framework > 4.x.

  (Note: The infrastructure is deprecated and is not receiving servicing or security fixes.)

  Open Windows explorer and search for all *.exe.config files. This requirement does not apply to the caspol.exe assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB).

  To find relevant files, run the FINDSTR command from an elevated (admin) command prompt: 
  FINDSTR /i /s "NetFx40_LegacySecurityPolicy" c:\*.exe.config 

  This command will search all ."exe.config" files on the c: drive partition for the "LegacySecurityPolicy" setting. Repeat the command for each drive partition on the system.

  If the .NET application configuration file uses the legacy policy element, and .NET STIG guidance that covers these legacy versions has not been applied, this is a finding.


vuln_id: V-225233
rule_id: SV-225233r961608_rule
severity: CAT II
title: Trust must be established prior to enabling the loading of remote code in .Net 4.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In the .NET Framework version 3.5 and earlier versions, if an application assembly loaded code/objects from a remote location, that assembly would run partially trusted with a permissions grant set that depended on the zone in which it was loaded. For example, if an assembly was loaded from a web site, it was loaded into the Internet zone and granted the Internet permission set. In other words, it was executed in an Internet sandbox.

  If the same program is run in the .NET Framework version 4, an exception is thrown which effectively states; either explicitly create a sandbox for the assembly or run it in full trust.

  The <loadFromRemoteSources> element specifies the assemblies that run partially trusted in earlier versions of the .NET Framework will be run fully trusted in the .NET Framework 4.

  If loadFromRemoteSources is set to true, the remotely loaded application code is granted full trust.  This could create an integrity vulnerability on the system.  The required method to address this is to explicitly create a sandboxed environment for the remotely loaded code to run in rather than allowing remotely loaded code to run with full trust.

  The appropriate level of trust must be established prior to enabling the loading of remote code in .Net 4 applications and that code must be run in a controlled environment.  The following is an example of the use of loadFromRemoteSources.

  <configuration>
  <runtime>
      <loadFromRemoteSources enabled="true" "https://my.dodorg.gov" />
      <loadFromRemoteSources enabled="true" "https://192.168.0.*" />
      <loadFromRemoteSources enabled="false" "*" />
  </runtime>
  </configuration></VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  .Net application code loaded from a remote source must be run in a controlled environment.  

  A controlled environment consists of a sandbox, such as running in an Internet Explorer host environment or employing OS based software access controls, such as AppLocker or Software Security Policies, when application design permits.  

  Obtain documented IAO approvals for all remotely loaded code.

check_text:
  Open Windows explorer and search for *.exe.config.

  Search each config file found for the "loadFromRemoteSources" element.

  If the loadFromRemoteSources element is enabled  
  ("loadFromRemoteSources enabled = true"), and the remotely loaded application is not run in a sandboxed environment, or if OS based software controls, such as AppLocker or Software Security Policies, are not utilized, this is a finding.


vuln_id: V-225234
rule_id: SV-225234r961863_rule
severity: CAT III
title: .NET default proxy settings must be reviewed and approved.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The .Net framework can be configured to utilize a different proxy or altogether bypass the default proxy settings in the client's browser.  This may lead to the framework using a proxy that is not approved for use.  If the proxy is malicious, this could lead to a loss of application integrity and confidentiality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open Windows explorer and search for all "*.exe.config" and "machine.config" files.

  Search each file for the "defaultProxy" element.

  Clear the values contained in the "defaultProxy" element, and the "bypasslist", "module", and "proxy" child elements.

  The IAO must provide documented approvals of any non-default proxy servers.

check_text:
  Open Windows explorer and search for all "*.exe.config" and "machine.config" files.

  Search each file for the "defaultProxy" element.

  <defaultProxy
    enabled="true|false"
    useDefaultCredentials="true|false"
    <bypasslist> … </bypasslist>
    <proxy> … </proxy>
    <module> … </module>
  />

  If the "defaultProxy" setting "enabled=false" or if the "bypasslist", "module", or "proxy" child elements have configuration entries and there are no documented approvals from the IAO, this is a finding.

   If the "defaultProxy" element is empty or if "useSystemDefault =True” then the framework is using default browser settings, this is not a finding.


vuln_id: V-225235
rule_id: SV-225235r960891_rule
severity: CAT II
title: Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Event tracing captures information about applications utilizing the .NET CLR and the .NET CLR itself. This includes security oriented information, such as Strong Name and Authenticode verification.  

  Beginning with Windows Vista, ETW is enabled by default however, the .Net CLR and .Net applications can be configured to not utilize Event Tracing. If ETW event tracing is disabled, critical events that occurred within the runtime will not be captured in event logs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open Windows explorer and search for all .NET config files including application config files (*.exe.config).

  Examine the configuration settings for 
  <etwEnable enabled="false" />.

  Enable ETW Tracing by setting the etwEnable flag to "true" or obtain documented IAO approvals.

check_text:
  Open Windows explorer and search for all .NET config files including application config files (*.exe.config)

  NOTE:
  Beginning with Windows Vista and Windows Server 2008, ETW Tracing is enabled by default and the "etwEnable" setting is not required in order for Event Tracing to be enabled.  An etwEnable setting of "true" IS required in earlier versions of Windows as ETW is disabled by default. 

  Examine the configuration settings for 
  <etwEnable enabled="false" />.

  If the "etwEnable" element is set to "true", this is not a finding.

  If the "etwEnable" element is set to "false" and documented approvals by the IAO are not provided, this is a finding.


vuln_id: V-225236
rule_id: SV-225236r1069477_rule
severity: CAT II
title: Software utilizing .Net 4.0 must be identified and relevant access controls configured.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>With the advent of .Net 4.0, the .Net framework no longer directly configures or enforces security policy for .Net applications.  This task is now relegated to the operating system layer and the security protections built-in to .Net application "runtime hosts" that run on the O.S. 

  Examples of these .Net "runtime hosts" include; Internet Explorer, Windows Shell, ASP.NET, Database Engines or any other "runtime hosts" that utilize .Net and load the .Net CLR.

  Security protections include utilizing runtime host security controls such as sandboxing to restrict or control application behavior as designed or required.  

  To compensate for these design changes, Windows provides native solutions such as Software Security Policies (SSP) and Application Locker (AL) which are technologies that can be implemented via Group Policy (GPO).  SSP, AL and similar third party solutions serve to restrict execution of applications, scripts and libraries based upon cryptographic hash, security zones, path and certificate values that are associated with the application files.  Additionally, application developers will utilize "sandboxing" techniques within their code in order to isolate 3rd party code libraries from critical system resources.

  In order to assign protections to .Net 4.0 applications, the applications must first be identified and the appropriate hosting security mechanisms configured to accomplish that task.  

  .Net STIG guidance cannot be applied if .Net applications are not identified and documented.  The lack of an application inventory introduces confidentiality, availability and integrity vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB).

  Document the corresponding runtime hosts that are used to invoke the applications.

  Document the applications security control requirements (restricting application access to resources or user access to the application).

check_text:
  This requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB).

  Ask the system administrator to provide documentation that identifies:

  - Each .Net 4.0 application run on the system.
  - The .Net runtime host that invokes the application. 
  - The security measures employed to control application access to system resources or user access to application.

  For additional insight run: tasklist /fi "modules eq mscoree.dll"

  If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding.

  If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding.

  If the runtime hosts have not been identified, this is a finding.

  If the security protections have not been identified, this is a finding.


vuln_id: V-225237
rule_id: SV-225237r1043178_rule
severity: CAT II
title: Remoting Services TCP channels must utilize authentication and encryption.
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Note: Microsoft recommends using the Windows Communication Framework (WCF) rather than .Net remoting. New development projects should refrain from using .Net remoting capabilities whenever possible.

  .NET remoting provides the capability to build widely distributed applications. The application components may reside all on one computer or they may be spread out across the enclave. .NET client applications can make remoting calls to use objects in other processes on the same computer or on any other computer that is reachable over the network. .NET remoting can also be used to communicate with other application domains within the same process. Remoting is achieved via the exposure of endpoints that can be used to establish remote connectivity.

  Normally when application code attempts to access a protected resource, a stack walk is performed to ensure that all stack frames have permission to access the resource. However, with .Net 4.0, when a call is made on a remote object, this stack walk is not performed across the remoting boundary. The .Net remoting infrastructure requires FullTrust permission to execute on either the client or the server. 

  Due to the fact that FullTrust permission is required, Remoting endpoints should be authenticated and encrypted in order to protect the system and the data. 

  Microsoft provides three different "channels" that are used for remoting. They are HTTP, TCP, and IPC.

  Any unauthorized use of a remoting application provides unauthorized access with FullTrust permissions to the system. This can potentially result in a loss of system integrity or confidentiality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If .NET remoting with TCP channel is not used, this fix is Not Applicable.

  Ensure encryption and message integrity are used for TCP remoting channels.

  TCP remoting connections are protected via the secure=true configuration parameter.
  <channels>
     <channel ref="tcp" secure="true" />
  </channels>

  Include the secure="true" flag in the channel ref parameter of the machine.config and [application name].exe.config file if the [application name].exe.config file exists on the system.

check_text:
  If .NET remoting with TCP channel is not used, this check is Not Applicable.

  Check the machine.config and the [application executable name].exe.config configuration files. 

  For 32-bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config 

  For 64-bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config.

  Microsoft specifies locating the application config file in the same folder as the application executable (.exe) file. However, the developer does have the capability to specify a different location when the application is compiled.  Therefore, if the config file is not found in the application home folder, a search of the system is required. If the [application name].exe.config file is not found on the system, then only a check of the machine.config file is required.

  Sample machine/application config file:

  <application name=“remoteserver”> 
    <service> 
      <activated type=“sample.my.object, myobjects”/> 
    </service> 
    <channels> 
      <channel ref=“tcp server” port=“6134”/> 
    </channels> 
  </application>

  <serverProviders>
    <provider ref="wsdl" />
    <formatter ref="soap" typeFilterLevel="Full" /> 
    <formatter ref="binary" typeFilterLevel="Full" /> 
  </serverProviders> 

  Microsoft provides three "channels" that are used for remoting connectivity. They are the HTTP, TCP, and IPC channels. The channel that is used is specified via the <channels> element in the config file.  

  TCP channel example:
  <channel ref=“tcp” port=“6134” secure="true"/> 

  The TCP channel provides encryption and message integrity when the "secure" flag is set to "true" as shown in the above example.

  If the "secure" flag is not set to "true" for the TCP channel, this is a finding.


vuln_id: V-225238
rule_id: SV-225238r1069480_rule
severity: CAT II
title: Update and configure the .NET Framework to support TLS.
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Use of the RC4 cipher in TLS could allow an attacker to perform man-in-the-middle attacks and recover plaintext from encrypted sessions. Applications that target .Net version 4.x running on multiple Windows versions could be vulnerable to these types of attacks. The registry settings in this requirement will prevent .Net applications that target the 4.x framework from selecting and utilizing the Schannel.dll RC4 cipher for TLS connections. Applications that use TLS when connecting to remote systems will perform a handshake and negotiate the TLS version and cipher that is to be used between the client and the server. This is standard protocol for all TLS connections. If the server and client are not configured to use the same TLS version and cipher, the TLS connection may fail. Applications should be tested with these registry settings prior to production implementation of the fix in order to avoid application outages.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. SchUseStrongCrypto enabled:

  Use regedit to access the following registry key.

  For 32-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\

  For 64-bit systems: 
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\

  Modify or create the following Windows registry value: SchUseStrongCrypto.

  Set SchUseStrongCrypto to a REG_DWORD value of "1".

  2. SystemDefaultTlsVersions enabled (.NET Framework >4.6):
  For 64-bit Windows, create a .reg file with the following content and apply it:
  Windows Registry Editor Version 5.00

  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
  "SystemDefaultTlsVersions"=dword:00000001

  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
  "SystemDefaultTlsVersions"=dword:00000001

  3. Restart the system for changes to take effect.

check_text:
  In older Windows systems (Windows Server 2012 or earlier), TLS 1.2 must be enabled systemwide by setting "SchUseStrongCrypto".

  SystemDefaultTlsVersions is a configuration switch in .NET Framework (starting from 4.6) that allows the application to use the default TLS version supported by the underlying Windows operating system instead of hardcoding a specific TLS version (like TLS 1.2).

  Check Registry:
  Use regedit to review the following Windows registry keys:
  For 32-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\

  For 64 bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\

  1. If the "SchUseStrongCrypto" value name does not exist, or is not a REG_DWORD type set to "1", this is a finding.

  2. For .NET Framework >4.6, use the default TLS version supported by the underlying Windows operating system.
  If the "SystemDefaultTlsVersions" value name does not exist, or is not a REG_DWORD type set to "1", this is a finding.

  Note: The SchUseStrongCrypto setting allows .NET to use TLS 1.1 and TLS 1.2. The SystemDefaultTlsVersions setting allows .NET to use the OS configuration.


vuln_id: V-235719
rule_id: SV-235719r1156558_rule
severity: CAT III
title: User control of proxy settings must be disabled.
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This action configures the proxy settings for Microsoft Edge.

  If this policy is enabled, Microsoft Edge ignores all proxy-related options specified from the command line.

  If this policy is not configured, users can choose their own proxy settings.

  This policy overrides the following individual policies:
  - ProxyMode.
  - ProxyPacUrl. 
  - ProxyServer. 
  - ProxyBypassList.

  Setting the ProxySettings policy accepts the following fields:
  - ProxyMode, which allows for the proxy server used by Microsoft Edge to be specified and prevents users from changing proxy settings.
  - ProxyPacUrl, a URL to a proxy .pac file.
  - ProxyServer, a URL for the proxy server.
  - ProxyBypassList, a list of proxy hosts that Microsoft Edge bypasses.

  For ProxyMode, the following values have the noted impact:
  - direct, a proxy is never used and all other fields are ignored.
  - system, the system's proxy is used and all other fields are ignored.
  - auto_detect, all other fields are ignored.
  - fixed_servers, the ProxyServer and ProxyBypassList fields are used.
  - pac_script, the ProxyPacUrl and ProxyBypassList fields are used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Proxy server/Proxy Settings" to "Enabled" and define a value for "ProxyMode".

  "ProxyMode" must be defined and set to one of the following: "direct", "system", "auto_detect", "fixed_servers", or "pac_script".

  Consult Microsoft documentation for proper configuration of the text string required to define the "Proxy Settings" value.

  Example:  {"ProxyMode": "fixed_servers", "ProxyServer": "127.0.0.1:8080"}

  "ProxyPacUrl", "ProxyServer", or "ProxyBypassList" are optional.

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Proxy server/Proxy Settings" must be "Enabled", and have a "Proxy Settings" value defined for "ProxyMode".

  "ProxyMode" must be defined and set to one of the following: "direct", "system", "auto_detect", "fixed_servers", or "pac_script".

  Consult Microsoft documentation for proper configuration of the text string required to define the "Proxy Settings" value.

  Example:  {"ProxyMode": "fixed_servers", "ProxyServer": "123.123.123.123:8080"}

  Values for "ProxyPacUrl", "ProxyServer", or "ProxyBypassList" are optional.

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the REG_SZ value for "ProxySettings" does not have "ProxyMode" configured, this is a finding.


vuln_id: V-235720
rule_id: SV-235720r960852_rule
severity: CAT II
title: Bypassing Microsoft Defender SmartScreen prompts for sites must be disabled.
cci: CCI-000870
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy setting allows a decision to be made on whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.

  If this setting is enabled, users cannot ignore Microsoft Defender SmartScreen warnings, and are blocked from continuing to the site.

  If this setting is disabled or not configured, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Prevent bypassing Microsoft Defender SmartScreen prompts for sites" to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Prevent bypassing Microsoft Defender SmartScreen prompts for sites" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "PreventSmartScreenPromptOverride" is not set to "REG_DWORD = 1", this is a finding.

  If this machine is on SIPRNet, this is Not Applicable.


vuln_id: V-235721
rule_id: SV-235721r960852_rule
severity: CAT II
title: Bypassing of Microsoft Defender SmartScreen warnings about downloads must be disabled.
cci: CCI-000870
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy setting allows a decision to be made on whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.

  If this setting is enabled, users cannot ignore Microsoft Defender SmartScreen warnings, and are prevented from completing the unverified downloads.

  If this policy is disabled or not configured, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads" must to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "PreventSmartScreenPromptOverrideForFiles" is not set to "REG_DWORD = 1", this is a finding.

  If this machine is on SIPRNet, this is Not Applicable.


vuln_id: V-235722
rule_id: SV-235722r960852_rule
severity: CAT III
cci: CCI-000870
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
title:
  The list of domains for which Microsoft Defender SmartScreen will not trigger warnings must be allowlisted if used.

description:
  <VulnDiscussion>Configure the list of Microsoft Defender SmartScreen trusted domains. This means Microsoft Defender SmartScreen will not check for potentially malicious resources, such as phishing software and other malware, if the source URLs match these domains. The Microsoft Defender SmartScreen download protection service will not check downloads hosted on these domains.

  If this policy is enabled, Microsoft Defender SmartScreen trusts these domains. If the policy is disabled or not set, default Microsoft Defender SmartScreen protection is applied to all resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure the list of domains for which Microsoft Defender SmartScreen will not trigger warnings" may be set to "allow" for allowlisted domains.

check_text:
  If this machine is on SIPRNet, this is Not Applicable.

  This requirement for "SmartScreenAllowListDomains" is not required; this is optional.

  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings" may be set to "allow" for allowlisted domains.

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  SmartScreenAllowListDomains may be set as follows:
  HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\1 = mydomain.com
  HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\2 = myagency.mil

  If configured, the list of domains for which Microsoft Defender SmartScreen will not trigger warnings may be allowlisted.


vuln_id: V-235723
rule_id: SV-235723r960864_rule
severity: CAT II
title: InPrivate mode must be disabled.
cci: CCI-000166
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting specifies whether the user can open pages in InPrivate mode in Microsoft Edge.

  If this policy is not configured or set it to "Enabled", users can open pages in InPrivate mode.

  Set this policy to "Disabled" to stop users from using InPrivate mode.

  Set this policy to "Forced" to always use InPrivate mode.

  Policy options mapping:
  - Enabled (0) = InPrivate mode available
  - Disabled (1) = InPrivate mode disabled
  - Forced (2) = InPrivate mode forced</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Configure InPrivate mode availability" to "enabled" and select "InPrivate mode disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Configure InPrivate mode availability" must be set to "enabled" with the option value set to "InPrivate mode disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "InPrivateModeAvailability" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235724
rule_id: SV-235724r960963_rule
severity: CAT II
title: Background processing must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Background processing allows Microsoft Edge processes to start at OS sign-in and keep running after the last browser window is closed. In this scenario, background apps and the current browsing session remain active, including any session cookies. An open background process displays an icon in the system tray, and can be closed from there.

  If this policy is enabled, background mode is turned on.

  If this policy is disabled, background mode is turned off.

  If this policy is not configured, background mode is initially turned off, and the user can configure its behavior in edge://settings/system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Continue running background apps after Microsoft Edge closes" to "Disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Continue running background apps after Microsoft Edge closes" must be set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "BackgroundModeEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235725
rule_id: SV-235725r960963_rule
severity: CAT II
title: The ability of sites to show pop-ups must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Set whether websites can show pop-up windows. Pop-ups can be allowed on all websites ("AllowPopups") or blocked on all sites ("BlockPopups").

  If this policy is configured, pop-up windows are blocked by default, and users can change this setting.

  Policy options mapping:
  - AllowPopups (1) = Allow all sites to show pop-ups.
  - BlockPopups (2) = Do not allow any site to show pop-ups.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Default pop-up window setting" to "Enabled" with the option value set to "Do not allow any site to show  pop-ups".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Default pop-up window setting" must be set to "Enabled" with the option value set to "Do not allow any site to show  pop-ups".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for DefaultPopupsSetting is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235726
rule_id: SV-235726r960963_rule
severity: CAT II
title: The default search provider must be set to use an encrypted connection.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows a list of list of up to 10 search engines to be configured, one of which must be marked as the default search engine. The encoding does not need to be specified. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.

  Starting in Microsoft Edge 83, search engine discovery can be enabled with the allow_search_engine_discovery optional parameter. This parameter must be the first item in the list. If allow_search_engine_discovery is not specified, search engine discovery will be disabled by default. Starting in Microsoft Edge 84, this policy can be set as a recommended policy to allow search provider discovery. The allow_search_engine_discovery optional parameter does not need to be added.

  If this policy is enabled, users cannot add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.

  If this policy is disabled or not configured, users can modify the search engines list as desired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Manage Search Engines".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Manage Search Engines" must be configured.

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  Example REG_SZ value text for "ManagedSearchEngines":
  [{"allow_search_engine_discovery": false},{"is_default": true,"name": "Microsoft Bing","keyword": "bing","search_url": "https://www.bing.com/search?q={searchTerms}"},{"name": "Google","keyword": "google","search_url": "https://www.google.com/search?q={searchTerms}"}]

  If any of the search URLs in the list do not begin with "https", this is a finding.


vuln_id: V-235727
rule_id: SV-235727r960963_rule
severity: CAT III
title: Data Synchronization must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.

  If this policy is not set or applied as recommended, users will be able to turn sync on or off. If this policy is applied as mandatory, users will not be able to turn on sync.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Disable synchronization of data using Microsoft sync services" to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Disable synchronization of data using Microsoft sync services" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "SyncDisabled" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235728
rule_id: SV-235728r960963_rule
severity: CAT II
title: Network prediction must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enables network prediction and prevents users from changing this setting.

  This controls DNS prefetching, TCP and SSL pre-connection, and pre-rendering of web pages.

  If this policy is not configured, network prediction is enabled but the user can change it.

  Policy options mapping:
  - NetworkPredictionAlways (0) = Predict network actions on any network connection.
  - NetworkPredictionWifiOnly (1) = Not supported; if this value is used it will be treated as if "Predict network actions on any network connection" (0) was set.
  - NetworkPredictionNever (2) = Do not predict network actions on any network connection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable network prediction" to "Enabled" with the option value set to "Don't predict network actions on any network connection".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable network prediction" must be set to "Enabled" with the option value set to "Don't predict network actions on any network connection".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for NetworkPredictionOptions is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235729
rule_id: SV-235729r960963_rule
severity: CAT II
title: Search suggestions must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enables web search suggestions in the Microsoft Edge Address Bar and Auto-Suggest List, and prevents users from changing this policy.

  If this policy is enabled, web search suggestions are used.

  If this policy is disabled, web search suggestions are never used; however, local history and local favorites suggestions still appear. If this policy is disabled, neither the typed characters nor the URLs visited will be included in telemetry to Microsoft.

  If this policy is not set, search suggestions are enabled but the user can change that.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable search suggestions" to "Disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable search suggestions" must be set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "SearchSuggestEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235730
rule_id: SV-235730r960963_rule
severity: CAT II
title: Importing of autofill form data must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import autofill form data from another browser into Microsoft Edge.

  If this policy is enabled, the option to manually import autofill data is automatically selected.

  If this policy is disabled, autofill form data is not imported at first run, and users cannot import it manually.

  If this policy is not configured, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.

  This policy cannot be set as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear autofill data option during manual import.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of autofill form data" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of autofill form data" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportAutofillFormData" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235731
rule_id: SV-235731r960963_rule
severity: CAT III
title: Importing of browser settings must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import browser settings from another browser into Microsoft Edge.

  If this policy is enabled, the Browser settings check box is automatically selected in the Import browser data dialog box.

  If this policy is disabled, browser settings are not imported at first run, and users cannot import them manually.

  If this policy is not configured, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of browser settings" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of browser settings" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportBrowserSettings" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235732
rule_id: SV-235732r960963_rule
severity: CAT II
title: Importing of cookies must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import cookies from another browser into Microsoft Edge.

  If this policy is disabled, cookies are not imported on first run.

  If this policy is not configured, cookies are imported on first run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of cookies" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of cookies" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportCookies" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235733
rule_id: SV-235733r960963_rule
severity: CAT II
title: Importing of extensions must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import extensions from another browser into Microsoft Edge.

  If this policy is enabled, the Extensions check box is automatically selected in the Import browser data dialog box.

  If this policy is disabled, extensions are not imported at first run, and users cannot import them manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of extensions" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of extensions" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportExtensions" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235734
rule_id: SV-235734r960963_rule
severity: CAT II
title: Importing of browsing history must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import their browsing history from another browser into Microsoft Edge.

  If this policy is enabled, the Browsing history check box is automatically selected in the Import browser data dialog box.

  If this policy is disabled, browsing history data is not imported at first run, and users cannot import this data manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of browsing history" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of browsing history" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportHistory" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235735
rule_id: SV-235735r960963_rule
severity: CAT II
title: Importing of home page settings must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import their home page setting from another browser into Microsoft Edge.

  If this policy is enabled, the option to manually import the home page setting is automatically selected.

  If this policy is disabled, the home page setting is not imported at first run, and users cannot import it manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of home page settings" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of home page settings" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportHomepage" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235736
rule_id: SV-235736r960963_rule
severity: CAT II
title: Importing of open tabs must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import open and pinned tabs from another browser into Microsoft Edge.

  If this policy is enabled, the Open tabs check box is automatically selected in the Import browser data dialog box.

  If this policy is disabled, open tabs are not imported at first run, and users cannot import them manually.

  If this policy is not configured, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of open tabs" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of open tabs" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportOpenTabs" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235737
rule_id: SV-235737r960963_rule
severity: CAT II
title: Importing of payment info must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import payment info from another browser into Microsoft Edge.

  If this policy is enabled, the payment info check box is automatically selected in the Import browser data dialog box.

  If this policy is disabled, payment info is not imported at first run, and users cannot import it manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of payment info" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of payment info" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportPaymentInfo" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235738
rule_id: SV-235738r960963_rule
severity: CAT II
title: Importing of saved passwords must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import saved passwords from another browser into Microsoft Edge.

  If this policy is enabled, the option to manually import saved passwords is automatically selected.

  If this policy is disabled, saved passwords are not imported on first run, and users cannot import them manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of saved passwords" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of saved passwords" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportSavedPasswords" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235739
rule_id: SV-235739r960963_rule
severity: CAT II
title: Importing of search engine settings must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import search engine settings from another browser into Microsoft Edge.

  If this policy is enabled, the option to import search engine settings is automatically selected.

  If this policy is disabled, search engine settings are not imported at first run, and users cannot import them manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of search engine settings" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of search engine settings" must be set to "disabled".

  Procedure: Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportSearchEngine" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235740
rule_id: SV-235740r960963_rule
severity: CAT II
title: Importing of shortcuts must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Allows users to import Shortcuts from another browser into Microsoft Edge.

  If this policy is disabled, Shortcuts are not imported on first run.

  If this policy is not configured, Shortcuts are imported on first run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of shortcuts" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of shortcuts" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ImportShortcuts" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235741
rule_id: SV-235741r1007485_rule
severity: CAT II
title: AutoplayAllowed must be set to disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy sets the media autoplay policy for websites.

  The default setting "Not configured" respects the current media autoplay settings and lets users configure their autoplay settings.

  Setting to "Enabled" sets media autoplay to "Allow". All websites are allowed to autoplay media. Users cannot override this policy.

  Setting to "Disabled" sets media autoplay to "Limit". This limits websites that are allowed to autoplay media to webpages with high media engagement and active WebRTC streams. Prior to Microsoft Edge version 92, this would set media autoplay to "Block". Users cannot override this policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay for websites" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay for websites" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "AutoplayAllowed" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235742
rule_id: SV-235742r960963_rule
severity: CAT II
title: WebUSB must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Set whether websites can access connected USB devices. Access can be blocked completely or the user asked each time a website wants to get access to connected USB devices.

  Override this policy for specific URL patterns by using the WebUsbAskForUrls and WebUsbBlockedForUrls policies.

  If this policy is not configured, sites can ask users whether they can access the connected USB devices ('AskWebUsb') by default, and users can change this setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Control use of the WebUSB API" to enabled" and select "Do not allow any site to request access to USB devices via the WebUSB API".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Control use of the WebUSB API" must be set to "enabled" with the option value set to "Do not allow any site to request access to USB devices via the WebUSB API".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "DefaultWebUsbGuardSetting" is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235743
rule_id: SV-235743r960963_rule
severity: CAT II
title: Google Cast must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.

  Disable this policy to disable Google Cast.

  By default, Google Cast is enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Cast/Enable Google Cast" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Cast/Enable Google Cast" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "EnableMediaRouter" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235744
rule_id: SV-235744r960963_rule
severity: CAT II
title: Web Bluetooth API must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Control whether websites can access nearby Bluetooth devices. Access can be blocked completely or the site required to ask the user each time it wants to access a Bluetooth device.

  If this policy is not configured, the default value ('AskWebBluetooth', meaning users are asked each time) is used and users can change it.

  Policy options mapping:
  - BlockWebBluetooth (2) = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API.
  - AskWebBluetooth (3) = Allow sites to ask the user to grant access to a nearby Bluetooth device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Control use of the Web Bluetooth API" to "enabled" with the option value set to "Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API.

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Control use of the Web Bluetooth API" must be set to "enabled" with the option value set to "Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "DefaultWebBluetoothGuardSetting" is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235745
rule_id: SV-235745r960963_rule
severity: CAT II
title: Autofill for Credit Cards must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enables the Microsoft Edge AutoFill feature and lets users auto complete credit card information in web forms using previously stored information.

  If this policy is disabled, AutoFill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.

  If this policy is enabled or not configured, users can control AutoFill for credit cards.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable AutoFill for credit cards" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable AutoFill for credit cards" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "AutofillCreditCardEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235746
rule_id: SV-235746r960963_rule
severity: CAT II
title: Autofill for addresses must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.

  If this policy is disabled, AutoFill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.

  If this policy is enabled or not configured, users can control AutoFill for addresses in the user interface.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable AutoFill for addresses" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable AutoFill for addresses" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "AutofillAddressEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235747
rule_id: SV-235747r961038_rule
severity: CAT II
title: Online revocation checks must be performed.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>If you enable this policy, Microsoft Edge will perform soft-fail, online OCSP/CRL checks. "Soft fail" means that if the revocation server can't be reached, the certificate will be considered valid.

  If you disable the policy or don't configure it, Microsoft Edge won't perform online revocation checks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable online OCSP/CRL checks" to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable online OCSP/CRL checks" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "EnableOnlineRevocationChecks" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235748
rule_id: SV-235748r960963_rule
severity: CAT II
title: Personalization of ads, search, and news by sending browsing history to Microsoft must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history to be used for personalizing advertising, search, news and other Microsoft services.

  This setting is only available for users with a Microsoft account. This setting is not available for child accounts or enterprise accounts.

  If this policy is disabled, users cannot change or override the setting. If this policy is enabled or not configured, Microsoft Edge will default to the user's preference.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow personalization of ads, search and news by sending browsing history to Microsoft" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow personalization of ads, search and news by sending browsing history to Microsoft" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "PersonalizationReportingEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235749
rule_id: SV-235749r960963_rule
severity: CAT II
title: Site tracking of a user’s location must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Set whether websites can track users' physical locations. Tracking can be allowed by default ("AllowGeolocation") or denied by default ("BlockGeolocation"), or the user can be asked each time a website requests their location ("AskGeolocation").

  If this policy is not configured, "AskGeolocation" is used and the user can change it.

  Policy options mapping:
  - AllowGeolocation (1) = Allow sites to track users' physical location.
  - BlockGeolocation (2) = Do not allow any site to track users' physical location.
  - AskGeolocation (3) = Ask whenever a site wants to track users' physical location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Default geolocation setting" to "enabled" and select "Don't allow any site to track users' physical location".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Default geolocation setting" must be set to "enabled" with the option value set to "Don't allow any site to track users' physical location".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "DefaultGeolocationSetting" is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235750
rule_id: SV-235750r960864_rule
severity: CAT II
title: Browser history must be saved.
cci: CCI-000166
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting disables deleting browser history and download history and prevents users from changing this setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable deleting browser and download history" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable deleting browser and download history" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "AllowDeletingBrowserHistory" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235751
rule_id: SV-235751r960963_rule
severity: CAT III
title: Edge development tools must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application-related data via the browser. Page elements, source code, javascript, API calls, application data, etc., may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Control where developer tools can be used" to "enabled" and select "Don't allow using the developer tools".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Control where developer tools can be used" with the option value set to "Don't allow using the developer tools".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "DeveloperToolsAvailability" is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235752
rule_id: SV-235752r1156563_rule
severity: CAT III
title: Download restrictions must be configured.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This configures the type of downloads that Microsoft Edge completely blocks without allowing users to override the security decision.

  Set "BlockDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known dangerous downloads or that have dangerous file type extensions.

  Set "BlockPotentiallyDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.

  Set "BlockAllDownloads" to block all downloads.

  Set "BlockMaliciousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.

  If this policy is not configured or the "DefaultDownloadSecurity" option is not set, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.

  Policy options mapping:

  DefaultDownloadSecurity (0) = No special restrictions

  BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types

  BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types

  BlockAllDownloads (3) = Block all downloads

  BlockMaliciousDownloads (4) = Block malicious downloads</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow download restrictions" to "Enabled" and select one of the following: "BlockDangerousDownloads", "Block potentially dangerous or unwanted downloads", "BlockAllDownloads", or "BlockMaliciousDownloads".

check_text:
  If this machine is on SIPRNet, this is Not Applicable.

  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow download restrictions" must be set to "Enabled" with the option value set to "BlockDangerousDownloads", "Block potentially dangerous or unwanted downloads", or "BlockMaliciousDownloads". The more restrictive option, "Block all downloads", is also acceptable.

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "DownloadRestrictions" is set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235753
rule_id: SV-235753r1015297_rule
severity: CAT III
title: URLs must be allowlisted for plugin use if used.
cci: CCI-003980,CCI-001812
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Define a list of sites, based on URL patterns that can open pop-up windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Allow pop-up windows on specific sites" to "Enabled". A list of allowlisted URLs may be specified here.

check_text:
  This requirement for "Allow pop-up windows on specific sites" is not required; this is optional.

  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Allow pop-up windows on specific sites" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  "PopupsAllowedForUrls" must be set as follows:
  HKLM\SOFTWARE\Policies\Microsoft\Edge\PopupsAllowedForUrls\1 = mydomain.com
  HKLM\SOFTWARE\Policies\Microsoft\Edge\PopupsAllowedForUrls\2 = myagency.mil

  If configured, the list of domains for which Microsoft Edge allows pop-ups may be allowlisted.


vuln_id: V-235754
rule_id: SV-235754r960963_rule
severity: CAT II
title: Extensions installation must be blocklisted by default.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>List specific extensions that users cannot install in Microsoft Edge. When this policy is deployed, any extensions on this list that were previously installed will be disabled, and the user will not be able to enable them. If an item is removed from the list of blocked extensions, the extension is automatically reenabled anywhere it was previously installed.

  Use "*" to block all extensions that are not explicitly listed in the allow list.

  If this policy is not configured, users can install any extension in Microsoft Edge.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Extensions/Control which extensions cannot be installed" to "Enabled". A list of blocklisted extensions may then be specified.

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Extensions/Control which extensions cannot be installed" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist\1

  If the value for "1" is not set to "REG_SZ = *", this is a finding.


vuln_id: V-235755
rule_id: SV-235755r961479_rule
severity: CAT III
title: Extensions that are approved for use must be allowlisted if used.
cci: CCI-001774
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>By default, all extensions are allowed. However, if all extensions are blocked by setting the "ExtensionInstallBlockList" policy to "*," users can only install extensions defined in this policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Extensions/Allow specific extensions to be installed" to "Enabled".  A list of allowlisted extensions may then be specified.

check_text:
  This requirement for "Allow specific extensions to be installed" is not required; this is optional.

  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Extensions/Allow specific extensions to be installed" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  "ExtensionInstallAllowlist" must be set as follows:
  HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist\1 = "extension_id1"
  HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist\2 = "extension_id2"

  If configured, the list of extensions for which Microsoft Edge allows to be installed may be allowlisted.


vuln_id: V-235756
rule_id: SV-235756r961521_rule
severity: CAT II
title: The Password Manager must be disabled.
cci: CCI-002007
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enable Microsoft Edge to save user passwords.

  If this policy is enabled, users can save their passwords in Microsoft Edge. The next time the user visits the site, Microsoft Edge will enter the password automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Password manager and protection/Enable saving passwords to the password manager" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Password manager and protection/Enable saving passwords to the password manager" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "PasswordManagerEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235758
rule_id: SV-235758r1117151_rule
severity: CAT I
title: The version of Microsoft Edge running on the system must be a supported version.
fix_text: Install a supported version of Edge.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. 

  Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). 

  This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process.

  The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Cross-reference the build information displayed with the Microsoft Edge site to identify, at minimum, the oldest supported build available. 

  If the installed version of Edge is not supported by Microsoft, this is a finding.


vuln_id: V-235760
rule_id: SV-235760r960963_rule
severity: CAT II
title: Site isolation for every site must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>The "SitePerProcess" policy can be used to prevent users from opting out of the default behavior of isolating all sites. The "IsolateOrigins" policy can be used to isolate additional, finer-grained origins.

  Enabling this policy prevents users from opting out of the default behavior where each site runs in its own process.

  If this policy is not disabled or configured, a user can opt out of site isolation (e.g., by using "Disable site isolation" entry in edge://flags.) Disabling the policy or not configuring the policy does not turn off Site Isolation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable site isolation for every site" to "enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable site isolation for every site" must be set to "enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "SitePerProcess" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235761
rule_id: SV-235761r1043177_rule
severity: CAT II
title: Supported authentication schemes must be configured.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting specifies which HTTP authentication schemes are supported.

  The policy can be configured by using these values: "basic", "digest", "ntlm", and "negotiate". Separate multiple values with commas.

  If this policy is not configured, all four schemes are used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/HTTP authentication/Supported authentication schemes" to "ntlm,negotiate".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/HTTP authentication/Supported authentication schemes" must be set to  "ntlm,negotiate".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "AuthSchemes" is not set to "REG_SZ = ntlm,negotiate", this is a finding.


vuln_id: V-235763
rule_id: SV-235763r960963_rule
severity: CAT II
title: Microsoft Defender SmartScreen must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy setting configures Microsoft Defender SmartScreen, which provides warning messages to help protect  users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on.

  If this setting is enabled, Microsoft Defender SmartScreen is turned on.

  If this setting is disabled, Microsoft Defender SmartScreen is turned off.

  If this setting is not configured, users can choose whether to use Microsoft Defender SmartScreen.

  This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure Microsoft Defender SmartScreen" to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure Microsoft Defender SmartScreen" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "SmartScreenEnabled" is not set to "REG_DWORD = 1", this is a finding.

  If this machine is on SIPRNet, this is Not Applicable.


vuln_id: V-235764
rule_id: SV-235764r960963_rule
severity: CAT II
title: Microsoft Defender SmartScreen must be configured to block potentially unwanted apps.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This policy setting configures blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default.

  If this setting is enabled, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on.

  If this setting is disabled, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off.

  If this setting is not configured, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen.

  This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are managed via MDM or joined to a domain via MCX.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure Microsoft Defender SmartScreen to block potentially unwanted apps" to "Enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure Microsoft Defender SmartScreen to block potentially unwanted apps" must be set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for SmartScreenPuaEnabled is not set to "REG_DWORD = 1", this is a finding.

  If this machine is on SIPRNet, this is Not Applicable.


vuln_id: V-235765
rule_id: SV-235765r960963_rule
severity: CAT III
title: The download location prompt must be configured.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting provides positive feedback before a download starts, limiting the possibility of inadvertent downloads without notifying the user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Ask where to save downloaded files" to "enabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Ask where to save downloaded files" must be set to "enabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "PromptForDownloadLocation" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235766
rule_id: SV-235766r1051115_rule
severity: CAT II
title: Tracking of browsing activity must be disabled.
cci: CCI-000388
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>The setting allows websites to be blocked from tracking users' web-browsing activity.

  If this policy is disabled or is not configured, users can set their own level of tracking prevention.

  Policy options mapping:
  - TrackingPreventionOff (0) = Off (no tracking prevention)
  - TrackingPreventionBasic (1) = Basic (blocks harmful trackers; content and ads will be personalized)
  - TrackingPreventionBalanced (2) = Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)
  - TrackingPreventionStrict (3) = Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization; some parts of sites might not work)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Block tracking of users' web-browsing activity" to "Balanced" or "Strict".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Block tracking of users' web-browsing activity" must be set to "Enabled" with the option value set to "Balanced" or "Strict".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "TrackingPrevention" is not set to "REG_DWORD = 2" or "REG_DWORD = 3", this is a finding.


vuln_id: V-235767
rule_id: SV-235767r960972_rule
severity: CAT II
title: A website's ability to query for payment methods must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting determines whether websites can check if the user has payment methods saved.

  If this policy is disabled, websites that use "PaymentRequest.canMakePayment" or "PaymentRequest.hasEnrolledInstrument" API will be informed that no payment methods are available.

  If this policy is enabled or is not set, websites can check to determine if the user has payment methods saved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow websites to query for available payment methods" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow websites to query for available payment methods" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for PaymentMethodQueryEnabled is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235768
rule_id: SV-235768r1015298_rule
severity: CAT II
title: Suggestions of similar web pages in the event of a navigation error must be disabled.
cci: CCI-000381,CCI-000767
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting allows Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.

  If this policy is enabled, a web service is used to generate URL and search suggestions for network errors.

  If this policy is disabled, no calls to the web service are made and a standard error page is shown.

  If this policy is not configured, Microsoft Edge respects the user preference that is set under Services at edge://settings/privacy. Specifically, there is a "Suggest similar pages when a webpage can't be found" toggle, which the user can switch on or off. 

  Note that if this policy has been enabled (AlternateErrorPagesEnabled), the "Suggest similar pages when a webpage can't be found setting" is turned on, but the user cannot change the setting by using the toggle. 

  If this policy is disabled, the "Suggest similar pages when a webpage can't be found" setting is turned off, and the user cannot change the setting by using the toggle.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Suggest similar pages when a webpage can't be found" to "Disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Suggest similar pages when a webpage can't be found" must be set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for AlternateErrorPagesEnabled is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235769
rule_id: SV-235769r960981_rule
severity: CAT II
title: User feedback must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Microsoft Edge uses the Edge Feedback feature (enabled by default) to allow users to send feedback, suggestions, or customer surveys and to report any issues with the browser. By default, users cannot disable (turn off) the Edge Feedback feature.

  If this policy is enabled or not configured, users can invoke Edge Feedback.

  If this policy is disabled, users cannot invoke Edge Feedback.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow user feedback" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow user feedback" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for UserFeedbackAllowed is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235770
rule_id: SV-235770r960984_rule
severity: CAT II
title: The collections feature must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting allows users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration.

  If this policy is enabled or not configured, users can access and use the Collections feature in Microsoft Edge.

  If this policy is disabled, users cannot access and use Collections in Microsoft Edge.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable the Collections feature" to "Disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable the Collections feature" must be set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "EdgeCollectionsEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235771
rule_id: SV-235771r960963_rule
severity: CAT II
title: The Share Experience feature must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>If this policy is set to "ShareAllowed" (the default), users will be able to access the Windows 10 Share experience from the Settings and More menu in Microsoft Edge to share with other apps on the system.

  If this policy is set to "ShareDisallowed", users will not be able to access the Windows 10 Share experience. If the Share button is on the toolbar, it will also be hidden.

  Policy options mapping:
  - ShareAllowed (0) = Allow using the Share experience.
  - ShareDisallowed (1) = Do not allow using the Share experience.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Configure the Share experience" to "Don't allow using the Share experience".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Configure the Share experience" must be set to "enabled" with the option value set to "Don't allow using the Share experience".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ConfigureShare" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-235772
rule_id: SV-235772r960963_rule
severity: CAT II
title: Guest mode must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Enabling Guest mode allows the use of guest profiles in Microsoft Edge. In a guest profile, the browser does not import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed.

  If this policy is enabled or not configured, Microsoft Edge lets users browse in guest profiles.

  If this policy is disabled, Microsoft Edge does not let users browse in guest profiles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable guest mode" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Enable guest mode" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "BrowserGuestModeEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-235773
rule_id: SV-235773r960993_rule
severity: CAT II
title: Relaunch notification must be required.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Users must be required to restart the browser to finish installation of pending updates and prevent users from continually using an old/vulnerable browser version.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Notify a user that a browser restart is recommended or required for pending updates" web-browsing activity to "Required".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Notify a user that a browser restart is recommended or required for pending updates" must be set to "Enabled" with the option value set to "Required".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "RelaunchNotification" is not set to "REG_DWORD = 2", this is a finding.


vuln_id: V-235774
rule_id: SV-235774r1015299_rule
severity: CAT II
title: The built-in DNS client must be disabled.
cci: CCI-001941,CCI-001942
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>This setting controls whether to use the built-in DNS client.

  This does not affect which DNS servers are used; it only controls the software stack that is used to communicate with them. For example, if the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. However, it is however possible that the built-in DNS client will address servers in different ways by using more modern DNS-related protocols such as DNS-over-TLS.

  If this policy is enabled, the built-in DNS client is used if it is available.

  If this policy is disabled, the client is never used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Use built-in DNS client" to "disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Use built-in DNS client" must be set to "disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "BuiltInDnsClientEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-246736
rule_id: SV-246736r960963_rule
severity: CAT II
title: Use of the QUIC protocol must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>QUIC is used by more than half of all connections from the Edge web browser to Google's servers, and this activity is undesirable in the DoD.

  If you enable this policy or don't configure it, the QUIC protocol is allowed.

  If you disable this policy, the QUIC protocol is blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow QUIC protocol" to "Disabled".

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow QUIC protocol" must be set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "QuicAllowed" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-251694
rule_id: SV-251694r960963_rule
severity: CAT III
title: The list of domains media autoplay allows must be allowlisted if used.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Define a list of sites, based on URL patterns, that are allowed to autoplay media.

  If this policy is not configured, the global default value from the AutoplayAllowed policy (if set) or the user's personal configuration is used for all sites.

  EDGE-00-000024 disables the AutoplayAllowed policy. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay on specific sites" may be set to "allow" for allowlisted domains.

check_text:
  If this machine is on SIPRNet, this is Not Applicable.

  This requirement for "AutoplayAllowlist" is not required; this is optional.

  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay on specific sites" may be set to "allow" for allowlisted domains.

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  AutoplayAllowlist may be set as follows:
  HKLM\SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\1 = mydomain.com
  HKLM\SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\2 = myagency.mil

  If configured, the list of domains for which autoplay is allowed may be allowlisted.


vuln_id: V-260465
rule_id: SV-260465r960963_rule
severity: CAT II
title: Visual Search must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Visual Search allows for quick exploration of more related content about entities in an image.

  If this policy is enabled or not configured, Visual Search will be enabled via image hover, context menu, and search in Sidebar.

  If this policy is disabled, Visual Search will be disabled and more information about images will not be available via hover, context menu, and search in Sidebar.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Visual search enabled" to "Disabled".

check_text:
  Verify the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Visual search enabled" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "VisualSearchEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-260466
rule_id: SV-260466r960963_rule
severity: CAT II
title: Copilot must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>The Sidebar is a launcher bar on the right side of Microsoft Edge's screen.

  If this policy is enabled or not configured, the Sidebar will be shown. If this policy is disabled, the Sidebar will never be shown.

  Disabling Sidebar will disable Copilot.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Show Hubs Sidebar" to "Disabled".

check_text:
  Verify the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Show Hubs Sidebar" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "HubsSidebarEnabled" is not set to "REG_DWORD = 0", this is a finding.


vuln_id: V-260467
rule_id: SV-260467r960864_rule
severity: CAT II
title: Session only-based cookies must be enabled.
cci: CCI-000166
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>Cookies must only be allowed per session and only for approved URLs as permanently stored cookies can be used for malicious intent. 

  Approved URLs may be allowlisted via the "CookiesAllowedForUrls" or "SaveCookiesOnExit" policy settings, but these are not requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Configure cookies" to "Enabled" with the option value set to "Keep cookies for the duration of the session, except ones listed in 'SaveCookiesOnExit'".

check_text:
  Verify the policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Configure cookies" is set to "Enabled" with the option value set to "Keep cookies for the duration of the session, except ones listed in 'SaveCookiesOnExit'".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for “DefaultCookiesSetting” is not set to "REG_DWORD = 4", this is a finding.


vuln_id: V-266981
rule_id: SV-266981r1169858_rule
severity: CAT II
title: FriendlyURLs must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:56:39
description:
  <VulnDiscussion>If FriendlyURLs are enabled, Microsoft Edge will compute additional representations of the URL and place them on the clipboard.

  This policy configures what format will be pasted when the user pastes in external applications, or inside Microsoft Edge without the "Paste As" context menu item.

  If configured, this policy makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the "Paste As" context menu will not be available.

  Not configured = The user will be able to choose their preferred paste format. By default, this is set to the friendly URL format. The "Paste As" menu will be available in Microsoft Edge.

  1 = No additional formats will be stored on the clipboard. There will be no "Paste as" context menu item in Microsoft Edge and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.

  3 = The user will get a friendly URL whenever they paste into surfaces that accept rich text. The plain URL will still be available for non-rich surfaces. There will be no "Paste As" menu in Microsoft Edge.

  4 = (Not currently used)

  The richer formats may not be well-supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.

  The recommended policy is available in Microsoft Edge 105 or later.

  Policy options mapping:

  PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.

  TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for "Computer Configuration/Administrative Templates/Microsoft EdgeConfigure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users" to "enabled" and select "The plain URL without any extra information, such as the page´s title. This is the recommended option when this policy is configured. For more information, see the description."

check_text:
  The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Configure the default paste format of URLs copied from Microsoft Edge and determine if additional formats will be available to users" must be set to "enabled" with the option value set to "The plain URL without any extra information, such as the page´s title. This is the recommended option when this policy is configured. For more information, see the description.".

  Use the Windows Registry Editor to navigate to the following key:
  HKLM\SOFTWARE\Policies\Microsoft\Edge

  If the value for "ConfigureFriendlyURLFormat" is not set to "REG_DWORD = 1", this is a finding.


vuln_id: V-221202
rule_id: SV-221202r960735_rule
severity: CAT II
title: Exchange must limit the Receive connector timeout.
cci: CCI-000054
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practices strategies for setting tuning. This configuration controls the number of idle minutes before the connection is dropped. It works in conjunction with the Maximum Inbound Connections Count setting.  

  Connections, once established, may incur delays in message transfer. If the timeout period is too long, there is risk that connections may be maintained for unnecessarily long time periods, preventing new connections from being established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP, or the applicable documentation.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -ConnectionTimeout 00:05:00 

  Note: The <IdentityName> value must be in single quotes.

  or 

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedures for each Receive connector.

check_text:
  Review the Email Domain Security Plan (EDSP), or Organizations applicable documentation.

  Determine the connection Timeout value.  

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, ConnectionTimeout

  For each Receive connector, if the value of "ConnectionTimeout" is not set to "00:05:00", this is a finding.

  or

  If "ConnectionTimeout" is set to another value other than "00:05:00" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221203
rule_id: SV-221203r960792_rule
severity: CAT II
title: Exchange servers must use approved DoD certificates.
fix_text: Remove the non-DoD certificate and import the correct DoD certificates.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. 

  Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. 

  This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeCertificate | Select CertificateDomains, issuer

  If the value of "CertificateDomains" does not indicate it is issued by the DoD, this is a finding.


vuln_id: V-221204
rule_id: SV-221204r960801_rule
severity: CAT II
title: Exchange must have accepted domains configured.
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Exchange may be configured to accept email for multiple domain names. This setting identifies the domains for which the server will accept mail. This check verifies the email server is not accepting email for unauthorized domains.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP.

  Open the Exchange Management Shell and enter the following command:
   
  Set-AcceptedDomain -Identity <'IdentityName'> -MakeDefault $true

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the Accepted Domain values.  

  Open the Exchange Management Shell and enter the following command:
   
  Get-AcceptedDomain | Select Name, DomainName, Identity, Default

  If the value of "Default" is not set to "True", this is a finding.

  or

  If the "Default" value for "AcceptedDomains" is set to another value other than "True" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221206
rule_id: SV-221206r960801_rule
severity: CAT II
title: Exchange external Receive connectors must be domain secure-enabled.
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal servers. This setting controls the authentication method used for communications between servers. With this feature enabled, messages can be securely passed from a partner domain securely.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from server to server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender.

  Individually, channel security and encryption can be compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -DomainSecureEnabled $true

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedures for each receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, DomainSecureEnabled

  For each receive connector, if the value of "DomainSecureEnabled" is not set to "True", this is a finding.


vuln_id: V-221207
rule_id: SV-221207r960879_rule
severity: CAT II
title: The Exchange email Diagnostic log level must be set to the lowest level.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Diagnostic logging, however, characteristically produces large volumes of data and requires care in managing the logs to prevent risk of disk capacity denial of service conditions. 

  Exchange diagnostic logging is broken up into 29 main "services", each of which has anywhere from 2 to 26 "categories" of events to be monitored. Moreover, each category may be set to one of four levels of logging: Lowest, Low, CAT II, and High, depending on how much detail one desires. The higher the level of detail, the more disk space required to store the audit material.

  Diagnostic logging is intended to help administrators debug problems with their systems, not as a general-purpose auditing tool. Because the diagnostic logs collect a great deal of information, the log files may grow large very quickly. Diagnostic log levels may be raised for limited periods of time when attempting to debug relevant pieces of Exchange functionality. Once debugging has finished, diagnostic log levels should be reduced again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-EventLogLevel -Identity <'IdentityName\EventlogName'> -Level Lowest

  Note: The <IdentityName\EventlogName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-EventLogLevel

  If any "EventLogLevel" values returned are not set to "Lowest", this is a finding.


vuln_id: V-221208
rule_id: SV-221208r960879_rule
severity: CAT II
title: Exchange Connectivity logging must be enabled.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A connectivity log is a record of the SMTP connection activity of the outbound message delivery queues to the destination mailbox server, smart host, or domain. Connectivity logging is available on Hub Transport servers and Edge Transport servers. By default, connectivity logging is disabled. If events are not recorded, it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.

  Note: Transport configuration settings apply to the organization/global level of the Exchange SMTP path. By checking and setting them at the Hub server, the setting will apply to both Hub and Edge roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -ConnectivityLogEnabled $true

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, ConnectivityLogEnabled

  If the value of "ConnectivityLogEnabled" is not set to "True", this is a finding.


vuln_id: V-221209
rule_id: SV-221209r960918_rule
severity: CAT II
title: Exchange Queue monitoring must be configured with threshold and action.
cci: CCI-000154
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Monitors are automated "process watchers" that respond to performance changes and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alerts if thresholds are reached, better enabling them to react in a timely fashion.

  This field offers choices of alerts when a "warning" or "critical" threshold is reached on the SMTP queue. A good rule of thumb (default) is to issue warnings when SMTP queue growth exceeds 10 minutes and critical messages when it exceeds 20 minutes, which should only exist occasionally. Frequent alerts against this counter may indicate a network or other issue (such as inbound SPAMMER traffic) that directly impacts email delivery.

  Notification choices include email alert to an email-enabled account (e.g., an email Administrator) or invoke a script to take other action (e.g., to add an Event to the Microsoft Application Event Log, where external monitors might detect it).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  perfmon

  In the left pane, navigate to Performance >> Data Collector Sets >> User Defined.

  In left pane, right-click on User Defined >> New >> Data Collector Set and configure the system to use the data collection set for monitoring the queues.

check_text:
  Note: If a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability NA.

  Open the Exchange Management Shell and enter the following command:

  perfmon

  In the left pane, navigate to Performance >> Data Collector Sets >> User Defined. 

  If no sets are defined or queues are not being monitored, this is a finding.


