Vulnslist

Cisco Unified Computing System Fabric System Manager Man-in-the-Middle Vulnerability

Cisco-SA-20130927-CVE-2012-4092 · Medium · Published 12 years ago · Updated 12 years ago

A vulnerability in the management interface of the Cisco Unified Computing System could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to improper identity validation of vCenter management consoles. An attacker could exploit this vulnerability by spoofing their identity and inserting themselves between the vCenter console and the Cisco Unified Computing System Manager. A successful exploit will allow the attacker to collect and modify data sent between the devices. Cisco has confirmed the vulnerability in a security notice; however, software updates are not available. To exploit this vulnerability, an attacker must be able to conduct a spoofing attack against the vCenter console to obtain the identity of the console. In addition, it is likely that an attacker would need access to trusted internal networks to be positioned between the vCenter console and an affected device. These conditions make it unlikely for an attacker to achieve a successful exploit. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

Related Products