Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?
IOS routers and ASA firewalls are on the "not affected" list. Those are what you'd find in most SMBs.
IOS-XR and NX-OS are affected, however. This software runs on the BFRs like you'd see in major ISPs and large networks.
> Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?
I'm speculating but based on what I know about Cisco gear, I'm gonna have to say no. At most, you'd get the same stuff you'd get from a server: the private keys, login credentials, copies of the configuration, etc. -- anything that's handled by the control plane of the routers, basically. The frames/packets passing through them are handled by ASICs and are never copied to the memory used by the CPU, AIUI.
Assuming best practices are followed, a random attacker would never be able to establish a connection (e.g. to 443/TCP) anyways, which would mitigate the risk. In a properly managed network, access to the router itself is highly restricted by ACLs and such.
If so an admin password might pop up in memory scans allowing a compromise. From there remote software can be downloaded to the router, potentially allowing snooping/mirroring of traffic.
But it's likely most of the them (ie the important ones) are behind local firewalls and VPNs.
And a lot of their WebEx, VoIP and VTC, which will be accessible either entirely within the organization, or on public networks.
Looks like most of their actual routers and stuff are not affected, which is unsurprising -- they SSH, not SSL, and it's unlikely they'd be running OpenSSL 1.0.1.