Cisco warns of a flaw in Nexus 9000 series switches that allows modifying encrypted traffic

Cisco warns of a high-severity vulnerability in Nexus 9000 series switches that can allow attackers to read or modify encrypted traffic.

Cisco disclosed a high-severity vulnerability, tracked as CVE-2023-20185 (CVSS Score 7.4), in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode.

An unauthenticated, remote attacker can exploit the flaw to read or modify encrypted traffic.

“This vulnerability is due to an issue with the implementation of the ciphers that are used by the CloudSec encryption feature on affected switches. An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption.” reads the advisory published by Cisco. “A successful exploit could allow the attacker to read or modify the traffic that is transmitted between the sites.”

Cisco Nexus 9000 Series Fabric Switches in ACI mode running releases 14.0 and later, that are part of a Multi-Site topology, and that have the CloudSec encryption feature enabled are impacted by this issue.

The vulnerability impacts Nexus 9332C and Nexus 9364C fixed spine switches, and Nexus 9500 spine switches equipped with a Nexus N9K-X9736C-FX line card.

The IT giant has not released security updates to address this flaw. The company recommends customers who are currently using the Cisco ACI Multi-Site CloudSec encryption feature for the Nexus 9332C and Nexus 9364C Switches and the Cisco Nexus N9K-X9736C-FX Line Card to disable it and contact their support organization to evaluate alternative options.

The company Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting this vulnerability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Nexus 9000)