CVE-2019-12621: Cisco HyperFlex Static SSL Key Vulnerability
First published: Wed Aug 21 2019(Updated: )
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Hyperflex Hx220c M5 Firmware | =3.0\(1a\) | |
| Cisco Hyperflex Hx220c M5 Firmware | =3.5\(2a\) | |
| Cisco Hyperflex Hx220c M5 | ||
| Cisco Hyperflex Hx240c M5 Firmware | =3.0\(1a\) | |
| Cisco Hyperflex Hx240c M5 Firmware | =3.5\(2a\) | |
| Cisco Hyperflex Hx240c M5 | ||
| Cisco Hyperflex Hx220c Af M5 Firmware | =3.0\(1a\) | |
| Cisco Hyperflex Hx220c Af M5 Firmware | =3.5\(2a\) | |
| Cisco Hyperflex Hx220c Af M5 | ||
| Cisco Hyperflex Hx240c Af M5 Firmware | =3.0\(1a\) | |
| Cisco Hyperflex Hx240c Af M5 Firmware | =3.5\(2a\) | |
| Cisco Hyperflex Hx240c Af M5 | ||
| Cisco Hyperflex Hx220c Edge M5 Firmware | =3.0\(1a\) | |
| Cisco Hyperflex Hx220c Edge M5 Firmware | =3.5\(2a\) | |
| Cisco Hyperflex Hx220c Edge M5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-12621?
CVE-2019-12621 is a vulnerability in Cisco HyperFlex Software that allows an unauthenticated remote attacker to perform a man-in-the-middle attack.
How severe is CVE-2019-12621?
CVE-2019-12621 has a severity rating of 7.4 (high).
What is the affected software for CVE-2019-12621?
The affected software for CVE-2019-12621 is Cisco HyperFlex Software versions 3.0(1a) and 3.5(2a).
How can an attacker exploit CVE-2019-12621?
An attacker can exploit CVE-2019-12621 by obtaining a specific encryption key for the cluster.
Is Cisco HyperFlex HX vulnerable to CVE-2019-12621?
No, Cisco HyperFlex HX is not vulnerable to CVE-2019-12621.
- agent/weakness
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/softwarecombine
- agent/description
- agent/references
- agent/title
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- vendor/cisco
- canonical/cisco hyperflex hx220c m5 firmware
- version/cisco hyperflex hx220c m5 firmware/3.0\(1a\)
- version/cisco hyperflex hx220c m5 firmware/3.5\(2a\)
- canonical/cisco hyperflex hx220c m5
- canonical/cisco hyperflex hx240c m5 firmware
- version/cisco hyperflex hx240c m5 firmware/3.0\(1a\)
- version/cisco hyperflex hx240c m5 firmware/3.5\(2a\)
- canonical/cisco hyperflex hx240c m5
- canonical/cisco hyperflex hx220c af m5 firmware
- version/cisco hyperflex hx220c af m5 firmware/3.0\(1a\)
- version/cisco hyperflex hx220c af m5 firmware/3.5\(2a\)
- canonical/cisco hyperflex hx220c af m5
- canonical/cisco hyperflex hx240c af m5 firmware
- version/cisco hyperflex hx240c af m5 firmware/3.0\(1a\)
- version/cisco hyperflex hx240c af m5 firmware/3.5\(2a\)
- canonical/cisco hyperflex hx240c af m5
- canonical/cisco hyperflex hx220c edge m5 firmware
- version/cisco hyperflex hx220c edge m5 firmware/3.0\(1a\)
- version/cisco hyperflex hx220c edge m5 firmware/3.5\(2a\)
- canonical/cisco hyperflex hx220c edge m5