Encryption Vulnerability in Cisco Nexus 9000 Series Switches

CVE-2023-20185

Summary

A vulnerability exists within the CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode, allowing an unauthenticated remote attacker to potentially read or modify encrypted intersite traffic. This issue stems from a weakness in the implementation of ciphers utilized for encryption. An attacker positioned on the path between ACI sites can exploit this vulnerability, employing cryptanalytic techniques to compromise the encryption. As a result, affected traffic may be intercepted and altered. Notably, Cisco has indicated that they will not release any software updates to remedy this vulnerability.

References