Cisco IOS XE Software Autonomic Networking Infrastructure Certificate Validation Vulnerability

A vulnerability in certificate validation for Autonomic Networking Infrastructure (ANI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to masquerade as another device.

The vulnerability is due to incomplete certificate validation. An attacker could exploit this vulnerability by sending crafted messages to the ANI device.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit this vulnerability, an attacker may need access to trusted, internal networks in which the targeted system may reside, in order to send crafted messages to the device. This access requirement may reduce the likelihood of a successful exploit.