CVE-2015-4259: cisco unified_computing_system Cryptographic Issues

Vulnerability summary

CVE-2015-4259 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in cisco unified_computing_system. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 54.9% of scored vulnerabilities.

Timeline

1. 10-07-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug IDs CSCum56133 and CSCum56177.

• CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.