Cisco Unified Computing System Fabric System Manager Man-in-the-Middle Vulnerability

A vulnerability in the management interface of the Cisco Unified Computing System could
allow an unauthenticated, remote attacker to perform a man-in-the-middle
attack.

The vulnerability is due to improper identity validation of vCenter management consoles. An attacker could exploit this
vulnerability by spoofing their identity and inserting themselves
between the vCenter console and the Cisco Unified Computing System
Manager. A successful exploit will allow the attacker to collect and
modify data sent between the devices.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit this vulnerability, an attacker must be able to conduct a spoofing attack against the vCenter console to obtain the identity of the console. In addition, it is likely that an attacker would need access to trusted internal networks to be positioned between the vCenter console and an affected device. These conditions make it unlikely for an attacker to achieve a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.