NS700 Firmware Update Frequency

[EveningStarNM]

My company is now the proud owner of two new Panasonic KX-NS700 hybrid PBX boxes. Unfortunately, the vendor doesn't seem to understand that they're computers that require operating system updates, particularly for security. In fact, the vendor told me that, under the maintenance contracts they have with their other customers (some of which are HIPAA regulated), they receive and install updates only once every three to five years. I want to hold their feet to the fire, but I've been unable to find out how to get notified of when updates are published. Panasonic holds such information close to the vest, preferring to let only Panasonic certified technicians service the machines. That's fine by me, since I've got plenty of other computers to administer, although, having looked at the documentation, the systems don't appear to be difficult to master. But I still want to know when updates are available and when the machines can be updated. Like everyone else, I've got Russian, Chinese, and Brazilian hackers -- not to mention the script kiddie down the street -- knocking on my doors ever single day.

I know that updates for the machines have been published several times a year, but I can't find a definitive list of updates, or how to subscribe for update information. I'll be grateful if someone here can tell me where to go to get it.

 

[WhiteGooner]

The updates for Panasonic are generally feature updates.

Security is down to the maintainer using non default ports, passwords and locking features by COS.

Its not like a pc where as lots of different coders trying to change data.

9 times out of 10 (in my 20+ years experience) the hackers are either SIP hackers or voice mail/disa hackers.

See above for solution.

 

[EveningStarNM]

It's an internet-facing Unix-based computer running on a processor that is vulnerable to all three variants of Spectre and any Unix or Apache exploits that haven't been patched.

 

[bigglesnz11]

This is some info I have had from Panasonic
- Main Unit
KX-NSX series : Target CPU is used. (This vulnerability is not concerned. *1)
KX-NS series except KX-NS1000 : Target CPU is used. (This vulnerability is not concerned. *1)
KX-NS1000 : Target CPU is NOT used.
KX-TDE/NCP series : Target CPU is NOT used.
*1 : The product does not support installing custom software

 

[EveningStarNM]

A lot of exploits run only from memory. Unfortunately, it looks like Panasonic has a bug bounty program only for their avionics and in-flight entertainment systems, and I can't find where anyone has ever run a pentest against their Unix-based PBX systems. That's going on my "Do This Next" list.