Cisco HyperFlex Static SSL Key Vulnerability

Vulnerability

Cisco HyperFlex Software releases prior to 4.0(1a) contain a static SSL encryption key that is used for cluster communication. The vulnerability is rooted in insufficient key management, meaning the same key is reused across installations. An attacker can obtain this key without authentication from a public source. [1]

Exploitation

An unauthenticated, remote attacker with network access to the cluster can obtain the static encryption key from publicly available information. Once in possession of the key, the attacker can position themselves between cluster nodes and intercept or modify traffic, effectively performing a man-in-the-middle attack. No prior authentication or user interaction is required beyond network access. [1]

Impact

Successful exploitation allows the attacker to decrypt, read, and potentially modify traffic between HyperFlex nodes. This compromises the confidentiality and integrity of all cluster communications, including sensitive operational data. The attacker does not gain direct administrative control but can observe and manipulate cluster operations. [1]

Mitigation

Cisco released software updates to address this vulnerability; the fix is available in Cisco HyperFlex Software Release 4.0(1a) and later. There are no workarounds. Customers should upgrade to a fixed release as soon as possible. [1]