Compliance Impact

The vulnerability allows unauthenticated network access to an API endpoint that can expose cluster metadata and invoke certain maintenance workflows, potentially disrupting active workloads and causing loss of service availability.

However, the vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data.

Given that no sensitive user data or credentials are exposed, the direct impact on compliance with data protection regulations such as GDPR or HIPAA is limited.

Nonetheless, the potential disruption of service availability could affect compliance with standards that require high availability and service continuity.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an improper access control issue in the Cisco Intersight Device Connector for Nutanix Prism Central. It involves an API passthrough endpoint exposed on TCP port 7373 that is accessible within the network without requiring authentication.

An attacker who has network access can exploit this by sending specially crafted requests to this endpoint to gather cluster metadata, such as virtual machine information and cluster configuration details.

While the API mainly supports read-only operations, it also permits invoking certain cluster maintenance workflows.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to disruption of active workloads within the affected environment, causing loss of service availability.

Although it does not allow persistent changes to system configurations or access to credentials or sensitive user data, the ability to invoke cluster maintenance workflows without authentication can impact operational stability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an exposed API passthrough endpoint on TCP port 7373 within the network scope of the deployment environment that does not require authentication.

To detect this vulnerability on your network or system, you can scan for open TCP port 7373 on devices running the Cisco Intersight Device Connector for Nutanix Prism Central.

A possible command to check for the open port could be using nmap:

• nmap -p 7373 <target-ip>

If the port is open, further testing with crafted requests to the API endpoint could confirm the vulnerability, but specific commands or scripts for this are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The CVE description does not provide explicit mitigation steps or patches.

However, since the vulnerability is due to an exposed unauthenticated API endpoint on TCP port 7373, immediate mitigation could include restricting network access to this port by implementing firewall rules or network segmentation to limit access only to trusted hosts.

Additionally, monitoring and limiting access to the Cisco Intersight Device Connector service and consulting Nutanix or Cisco support for updates or patches is recommended.

Useful 0 Not Useful 0