Description
Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic to an Autosupport server and leveraging knowledge of this key from another installation, aka Bug ID CSCur85504.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1035957
Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160524-ucs-inv
Scores
CVSS v3
7.5
EPSS
0.0114
EPSS Percentile
62.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (6)
cisco/ucs_invicta_c3124sa_appliance
4.3.1
cisco/ucs_invicta_c3124sa_appliance
4.3_base
cisco/ucs_invicta_c3124sa_appliance
4.5.0
cisco/ucs_invicta_c3124sa_appliance
4.5_base
cisco/ucs_invicta_c3124sa_appliance
5.0.1
cisco/ucs_invicta_c3124sa_appliance
5.0_base
Published
May 29, 2016
Tracked Since
Feb 18, 2026