Cisco Warns of High-Severity Vulnerability in Data Center Switches Allowing Tampering with Encrypted Traffic
Cisco issued a warning to its customers today regarding a high-severity vulnerability that affects certain data center switch models. Tracked as CVE-2023-20185, the flaw was discovered during internal security testing in the ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches.
The vulnerability specifically impacts Cisco Nexus 9332C, 9364C, and 9500 spine switches that are in ACI mode, part of a Multi-Site topology, have the CloudSec encryption feature enabled, and are running firmware 14.0 and later releases.
See Also: So you want to be a hacker?
Offensive Security, Bug Bounty Courses
If successfully exploited, this vulnerability allows unauthorized attackers to tamper with encrypted traffic exchanged between sites remotely. The issue lies in the implementation of ciphers used by the CloudSec encryption feature on the affected switches.
There is no patch available from Cisco.
Currently, Cisco has not released software updates to address the CVE-2023-20185 vulnerability. As a precautionary measure, customers using the affected data center switches are advised to disable the vulnerable feature and consult their support organization for alternative solutions.
Trending: Recon Tool: Logsensor
Cisco’s Product Security Incident Response Team (PSIRT) has not identified any signs of active exploitation or public exploit code targeting the vulnerability. Additionally, the company is actively working to patch a cross-site scripting (XSS) bug reported in the Prime Collaboration Deployment (PCD) server management tool.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: [email protected]
Source: bleepingcomputer.com
Recent News
Offensive Security & Ethical Hacking Course
Begin the learning curve of hacking now!
Information Security Solutions
Find out how Pentesting Services can help you.
