CVE-2019-12621: Cisco HyperFlex HX220C Af m5 Firmware

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.

Affected products

• Cisco HyperFlex HX220C Af m5 Firmware: version 3.0(1a) only; version 3.5(2a) only
• Cisco HyperFlex HX220C Edge m5 Firmware: version 3.0(1a) only; version 3.5(2a) only
• Cisco HyperFlex HX220C m5 Firmware: version 3.0(1a) only; version 3.5(2a) only
• Cisco HyperFlex HX240C Af m5 Firmware: version 3.0(1a) only; version 3.5(2a) only
• Cisco HyperFlex HX240C m5 Firmware: version 3.0(1a) only; version 3.5(2a) only

Published 2019-08-21. Last modified 2026-06-17.