CVE-2019-12621
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
- Score
- CVSS 3.1 7.4 High
- Status
- Modified - psirt@cisco.com
- Published
- 2019-08-21
- Last modified
- 2024-11-20
- Weaknesses
- CWE-320, CWE-327
Affected products
- Cisco Hyperflex Hx-series (Cisco)
- Hyperflex Hx220c Af M5 Firmware (Cisco)
- Hyperflex Hx220c Edge M5 Firmware (Cisco)
- Hyperflex Hx220c M5 Firmware (Cisco)
- Hyperflex Hx240c Af M5 Firmware (Cisco)
- Hyperflex Hx240c M5 Firmware (Cisco)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey
