FLEX H Firmware Boot Issues

There is a security flaw in the current firmware of my device (and most probably other devices of this series).

When the device is rebooted, the configuration on the interfaces is applied and for round about one minute, the configured Firewall rules are not applied.

I realized that when rebooting my device with service PING not allowed towards the Device, but the PING went through during bootup.

Even worse is, that for example NAT rules are anyway applied - and then not filtered.

In combination with a Denial of Service Attack this will lead to information exposure.

Tested Device:

V1.37(ABXF.1) running on USG FLEX 100H.

Suggested Remediation: A general Deny ALL must be applied as long as the bootup is not completely finished.

I wrote this first to the security mail address, but they redirected me here. :)