Cisco has disclosed a significant vulnerability in the encryption employed in certain models of its Nexus 9000 switches. However, the company has stated that this bug will not be remedied.
The vulnerability pertains to the Cisco ACI multi-site CloudSec encryption feature in ACI mode on Nexus 9000 Series fabric switches. It could potentially allow an unauthorized remote attacker to intercept encrypted traffic between ACI sites and exploit cryptanalysis to compromise the encryption, thereby gaining the ability to “read or modify” the transmitted data.
This issue affects Cisco Nexus 9332C and Nexus 9364C switches, as well as the Cisco Nexus N9K-X9736C-FX line card. The advisory recommends disabling encryption on these devices.
Despite the severity of the vulnerability, which has a CVSS score of 7.4 (rated as High), Cisco has chosen not to release software updates or provide workarounds to address the problem. As a result, customers currently utilizing the affected Cisco ACI multi-site CloudSec encryption feature are advised to disable it and seek alternative options through their support organization.
Given the absence of a fix, it is likely that the impacted units will need to be replaced.
