Connect with us

Hi, what are you looking for?



Vulnerability in Cisco Enterprise Switches Allows Attackers to Modify Encrypted Traffic

Cisco says a high-severity vulnerability in Nexus 9000 series switches could allow attackers to intercept and modify encrypted traffic.

Cisco this week informed customers about a high-severity vulnerability in its Nexus 9000 series switches that could allow unauthenticated attackers to intercept and modify traffic.

Tracked as CVE-2023-20185, the issue impacts the ACI multi-site CloudSec encryption feature of the Nexus 9000 switches that are configured in application centric infrastructure (ACI) mode – typically used in data centers for controlling physical and virtual networks.

An issue with the implementation of the ciphers used by the CloudSec encryption feature allows a remote, unauthenticated attacker to intercept encrypted traffic between sites and break the encryption using cryptanalytic techniques. The attacker could then read or modify the traffic.

“This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI mode that are running releases 14.0 and later if they are part of a multi-site topology and have the CloudSec encryption feature enabled,” Cisco explains in an advisory.

The issue impacts Nexus 9332C and Nexus 9364C fixed spine switches, and Nexus 9500 spine switches equipped with a Nexus N9K-X9736C-FX line card.

Cisco has not released patches to address the vulnerability and recommends that customers using vulnerable switches disable the ACI multi-site CloudSec encryption feature.

This week, the tech giant released software updates to address four medium-severity issues in Webex Meetings, Duo Authentication Proxy, and BroadWorks.

Advertisement. Scroll to continue reading.

Successful exploitation of these vulnerabilities could lead to cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks, information leaks, and privilege escalation.

Cisco says it is not aware of any malicious attacks or public proof-of-concept (PoC) code targeting these flaws. Additional information on the vulnerabilities can be found on Cisco’s security advisories page.

Related: PoC Exploit Published for Cisco AnyConnect Secure Vulnerability

Related: Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions

Related: Cisco Says PoC Exploits Available for Newly Patched Enterprise Switch Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.