What’s Vulnerable › Vulnerabilities
CVE-2019-12621: Cisco HyperFlex Static SSL Key Vulnerability
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-21 · updated 2026-06-17
- Weakness: CWE-320
Description
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
Affected products
- Cisco Hyperflex Hx220C Af M5 Firmware: 3.0(1a), 3.5(2a)
- Cisco Hyperflex Hx220C Edge M5 Firmware: 3.0(1a), 3.5(2a)
- Cisco Hyperflex Hx220C M5 Firmware: 3.0(1a), 3.5(2a)
- Cisco Hyperflex Hx240C Af M5 Firmware: 3.0(1a), 3.5(2a)
- Cisco Hyperflex Hx240C M5 Firmware: 3.0(1a), 3.5(2a)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey
Get alerted when CVE-2019-12621 or the next vulnerability affects your stack