Executive brief
The Cohesity TranZman Migration Appliance, used for moving data between backup environments, uses a weak and easily reversible method to protect its communications. Because the system uses a fixed, public key to scramble data, an attacker on the same network can easily unscramble the traffic to steal login credentials and sensitive file names. This could allow an unauthorized person to intercept or tamper with backup data during a migration process.
Technical details
The TranZman FTP service (port 55555/TCP) utilizes a custom 'SRLCRYPT' obfuscation layer that relies on a static, hardcoded XOR key. This key is a plaintext copyright string embedded within the Perl-based 'SRCrypt::srcrypt' module. Because XOR is its own inverse and the key is fixed across installations, any attacker capable of capturing network traffic can trivially decrypt the FTP control channel. This exposes plaintext credentials, filenames, and commands. Furthermore, the lack of integrity checks allows for command forgery or replay attacks, and the service includes logic to suppress certain logs (SITE log), potentially hiding malicious activity. Cohesity has released patches (TZM_patch_1.patch and TZM_1760106063_OCT2025R2_FULL.depot) to address the issue.
Affected products
- Cohesity TranZman Migration Appliance Release 4.0 Build 14614 (including patch TZM_1757588060_SEP2025_FULL.depot)
Timeline
- 2025-09-26: disclosed: Vulnerability reported to Cohesity
- 2025-10-20: patched: Cohesity confirmed fix in patches
- 2025-12-27: advisory: Public disclosure by researcher
- 2026-03-03: advisory: NVD publication date