7.4
CVE-2019-12621
- EPSS 0.38%
- Veröffentlicht 21.08.2019 18:15:13
- Zuletzt bearbeitet 21.11.2024 04:23:12
- Erkennungen
LoginCisco HyperFlex Static SSL Key Vulnerability
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Hyperflex Hx220c M5 Firmware Version 3.0(1a)
Cisco ≫ Hyperflex Hx220c M5 Firmware Version 3.5(2a)
Cisco ≫ Hyperflex Hx240c M5 Firmware Version 3.0(1a)
Cisco ≫ Hyperflex Hx240c M5 Firmware Version 3.5(2a)
Cisco ≫ Hyperflex Hx220c Af M5 Firmware Version 3.0(1a)
Cisco ≫ Hyperflex Hx220c Af M5 Firmware Version 3.5(2a)
Cisco ≫ Hyperflex Hx240c Af M5 Firmware Version 3.0(1a)
Cisco ≫ Hyperflex Hx240c Af M5 Firmware Version 3.5(2a)
Cisco ≫ Hyperflex Hx220c Edge M5 Firmware Version 3.0(1a)
Cisco ≫ Hyperflex Hx220c Edge M5 Firmware Version 3.5(2a)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.38% | 0.292 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.4 | 2.2 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
|
| NIST | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
| Cisco PSIRT | 6.8 | 1.6 | 5.2 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
|
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey