cisco-sa-nd-tlsvld-TbAQLp3N: Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

Published Jul 20, 2022
·
Updated

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus Dashboard Fabric Controller, formerly Data Center Network Manager (DCNM) controllers. An attacker could exploit this vulnerability by using man-in-the-middle techniques to intercept the traffic between the affected device and the controllers, and then using a crafted certificate to impersonate the controllers. A successful exploit could allow the attacker to alter communications between devices or view sensitive information, including Administrator credentials for these controllers. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-tlsvld-TbAQLp3N

Credit

by Logan Sanderson(the Cisco Advanced Security Initiatives Group)

Affected Software

1 affected componentFixes available
Cisco Nexus Dashboard>=1.1, =2.0, =2.1, <=2.2, <2.2(1h)
2.2(1h)

Event History

Jul 20, 2022
Advisory Published
via Cisco·04:00 PM

Child vulnerabilities

Contains the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is Cisco Nexus Dashboard SSL Certificate Validation Vulnerability?

Cisco Nexus Dashboard is vulnerable to SSL certificate validation issues, allowing unauthenticated remote attackers to manipulate communications or access sensitive information.

2

What is the severity of Cisco Nexus Dashboard SSL Certificate Validation Vulnerability?

The severity of the Cisco Nexus Dashboard SSL Certificate Validation Vulnerability is high with a CVSS score of 7.4.

3

Which versions of Cisco Nexus Dashboard are affected by this vulnerability?

Cisco Nexus Dashboard versions 1.1, 2.0, 2.1, up to and including 2.2(1h) are affected by this vulnerability.

4

How can an attacker exploit this vulnerability?

An unauthenticated remote attacker can exploit this vulnerability by altering communications with associated controllers or viewing sensitive information.

5

Is there a fix available for Cisco Nexus Dashboard SSL Certificate Validation Vulnerability?

Yes, Cisco has provided a remedy for this vulnerability by releasing version 2.2(1h) and recommends upgrading to a fixed software release.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
cisco-sa-nd-tlsvld-TbAQLp3N - Cisco Nexus Dashboard SSL Certificate Validation Vulnerability - SecAlerts