Cisco has revealed a serious vulnerability in the encryption used in certain Nexus 9000 switches, stating that the bug will not be remedied. The vulnerability affects the Cisco ACI multi-site CloudSec encryption feature and can enable an unauthenticated remote attacker to intercept and potentially modify encrypted traffic between ACI sites.
The flaw impacts Cisco Nexus 9332C and Nexus 9364C switches, as well as the Cisco Nexus N9K-X9736C-FX line card. The advisory recommends disabling encryption on these devices due to the vulnerability. Unfortunately, Cisco has not released any software updates to address the issue, and there are no workarounds available.
Customers currently using the affected devices are advised to disable the Cisco ACI multi-site CloudSec encryption feature and consult with their support organization to explore alternative options. As there is no fix, it is likely that affected units will need to be replaced.