Cisco HyperFlex Software Counter Value Injection Vulnerability

Vulnerability

Cisco HyperFlex Software releases 3.5.2f and earlier and 4.0.1b and earlier contain a vulnerability in the statistics collection service that allows an unauthenticated, remote attacker to inject arbitrary values. The vulnerability is due to insufficient authentication for the statistics collection service, enabling the attacker to send properly formatted data values to the service [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending specially crafted data values to the statistics collection service of an affected device. The attacker does not need any prior access or user interaction to perform the injection [1].

Impact

Successful exploitation allows the attacker to inject arbitrary counter values, causing the web interface statistics view to present invalid data to users. This impacts the integrity of the displayed information but does not provide code execution or privilege escalation [1].

Mitigation

Cisco has not released a software update that addresses this vulnerability at the time of publication. There are no workarounds available. Users should monitor Cisco Security Advisories for future fixed releases [1].