Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv) and Security Management Virtual Appliance (SMAv) have the flaw which is caused by preinstalled SSH encryption keys.

The company said: "A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv and Cisco SMAv Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user."

"The vulnerability is due to the presence of a default authorised SSH key that is shared across all the installations of WSAv, ESAv and SMAv. An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv or SMAv."

Exploitation of the flaws could allow an "unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliance".

Cisco has issued updates and it is urging companies to install these post haste.

Security updates are nothing new but following Edward Snowden's revelations about how the US spooks had backdoors into Cisco products we have to wonder if this error was deliberate or not.