Vulnerability scan keeps flagging weak ciphers
Posted: Wed Oct 28, 2026 4:24 am
Vulnerability scan keeps flagging weak ciphers no matter what i do I've set the encryption in the gui to AES256-GCM-SHA384 I've edited the conf file to disable tls 1.0 and 1.1 the line in the conf file shows string CipherName AES256-GCM-SHA384 I've turned off the OVPN clone function and the MS SSTP setting.. it keeps coming back with Vulnerability Detection Result
'DHE' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Impact
This vulnerability allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, also known as a D(HE)ater attack. There could be an increase in CPU usage in the affected component. For OpenSSH, users may observe issues such as a slowdown in SSH connections.
and
Vulnerability Detection Result
'Vulnerable' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_RSA_WITH_3DES_EDE_CBC_SHA (SWEET32)
Impact
This could allow remote attackers to obtain sensitive information or have other, unspecified impacts.
Even ran ISS Crypto and tried turning off the weak ciphers at the OS level with no luck. There are some places with commands to run the command line to eliminate
Softether from using these ciphers but it comes back with the commands not working it doesn't recognize the commands. Anybody have any
ideas?
'DHE' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Impact
This vulnerability allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, also known as a D(HE)ater attack. There could be an increase in CPU usage in the affected component. For OpenSSH, users may observe issues such as a slowdown in SSH connections.
and
Vulnerability Detection Result
'Vulnerable' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_RSA_WITH_3DES_EDE_CBC_SHA (SWEET32)
Impact
This could allow remote attackers to obtain sensitive information or have other, unspecified impacts.
Even ran ISS Crypto and tried turning off the weak ciphers at the OS level with no luck. There are some places with commands to run the command line to eliminate
Softether from using these ciphers but it comes back with the commands not working it doesn't recognize the commands. Anybody have any
ideas?