Cisco this week informed customers about a high-severity vulnerability in its Nexus 9000 series switches that could allow unauthenticated attackers to intercept and modify traffic.
Tracked as CVE-2023-20185, the issue impacts the ACI multi-site CloudSec encryption feature of the Nexus 9000 switches that are configured in application centric infrastructure (ACI) mode – typically used in data centers for controlling physical and virtual networks.
An issue with the implementation of the ciphers used by the CloudSec encryption feature allows a remote, unauthenticated attacker to intercept encrypted traffic between sites and break the encryption using cryptanalytic techniques. The attacker could then read or modify the traffic.
“This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI mode that are running releases 14.0 and later if they are part of a multi-site topology and have the CloudSec encryption feature enabled,” Cisco explains in an advisory.
The issue impacts Nexus 9332C and Nexus 9364C fixed spine switches, and Nexus 9500 spine switches equipped with a Nexus N9K-X9736C-FX line card.
Cisco has not released patches to address the vulnerability and recommends that customers using vulnerable switches disable the ACI multi-site CloudSec encryption feature.
This week, the tech giant released software updates to address four medium-severity issues in Webex Meetings, Duo Authentication Proxy, and BroadWorks.
Successful exploitation of these vulnerabilities could lead to cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks, information leaks, and privilege escalation.
Cisco says it is not aware of any malicious attacks or public proof-of-concept (PoC) code targeting these flaws. Additional information on the vulnerabilities can be found on Cisco’s security advisories page.
Related: PoC Exploit Published for Cisco AnyConnect Secure Vulnerability
Related: Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
Related: Cisco Says PoC Exploits Available for Newly Patched Enterprise Switch Vulnerabilities