Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| None | n/a | cisco-sa-emudhra-info-ScS22A1r |
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
CiscoCisco IOS XR Software, Cisco Secure Firepower Management Center (FMC) Software, Cisco ThousandEyes Enterprise Agent, Cisco Duo Access Gateway, Cisco Duo Agentic Authorization Connector, Cisco Duo Network Gateway, Cisco Meraki Dashboard, Cisco Meraki MV Smart Camera Firmware, Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure
|
Cisco PSIRT | |||
|
cisco-sa-emudhra-info-ScS22A1rCisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Executive summaryCisco says eight intermediate certificates from the certificate authority eMudhra have weak private keys that can be brute-forced within seconds, so attackers could issue fraudulent TLS and code signing certificates. Cisco is still investigating its product line, and the advisory names a limited set of Cisco products as impacted, with some fixes or cloud remediation under way. Cisco recommends reviewing the vulnerable products table and applying the listed upgrades or remediation steps. Technical summaryThe flaw is a cryptographic key weakness: the private keys for eight eMudhra intermediate certificates were broken by an error in their April 2025 Key Generation Ceremony, so anyone can brute-force them, and the eight certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025. The advisory says the issue lets holders of these keys issue fraudulent TLS certificates for any domain and sign malicious code, and it states that a public announcement exists but that Cisco PSIRT is not aware of malicious use. The advisory lists target release dates and upgrade versions for some products, including Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, IOS XR Software 26.4.1 (target Nov 30, 2026), and Ultra Cloud Core - Subscriber Microservices Infrastructure 2026.04.1 (Nov 2026), but it does not give fixed versions for every product. The header states no workarounds are available, and the advisory says any workarounds will be documented in the Vulnerable Products section. Secure Firepower Management Center has a Cisco TechZone article for configuring a TLS policy to block known eMudhra certificate issuers. Detection guidance beyond that is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…mudhra-info-ScS22A1r ScoreNo CVSS score published. AffectsCiscoCisco IOS XR SoftwareCisco Secure Firepower Management Center (FMC) SoftwareCisco ThousandEyes Enterprise AgentCisco Duo Access GatewayCisco Duo Agentic Authorization ConnectorCisco Duo Network GatewayCisco Meraki DashboardCisco Meraki MV Smart Camera FirmwareCisco Ultra Cloud Core - Subscriber Microservices Infrastructure
Cisco Product Security Incident Response TeamPublished
Read the advisory
|
|||||||