Cisco Nexus 3000 and 9000 Series Switches Intermediate System-to-Intermediate System Denial of Service Vulnerability

TL;DR 📌

A high-severity vulnerability has been identified in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco Nexus 3000 and 9000 Series Switches. This vulnerability could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) by sending a crafted IS-IS packet, leading to an unexpected device reload. Cisco has released software updates to address this issue, but no workarounds are available.

What happened 🕵️‍♂️

A vulnerability in the IS-IS feature of Cisco NX-OS Software could allow an adjacent attacker to exploit insufficient input validation when parsing IS-IS packets. By sending a specially crafted packet, the attacker could cause the IS-IS process to restart unexpectedly, resulting in a denial of service condition as the affected device reloads.

Affected products 🖥️

• Cisco Nexus 3000 Series Switches
• Cisco Nexus 9000 Series Switches in standalone NX-OS mode

To determine if the IS-IS protocol is enabled on your switch, use the command: show running-config | include isis.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds available for this vulnerability. However, it is recommended to configure IS-IS area authentication to mitigate potential exploitation. This requires attackers to pass the authentication phase before triggering the vulnerability.

Risk in context 🎯

The vulnerability has a CVSS score of 7.4, indicating a high risk. It is exploitable by an unauthenticated attacker who is Layer 2-adjacent to the affected device. There is potential for significant operational impact due to device reloads, which could disrupt network services.

Fast facts ⚡

• Vulnerability: IS-IS Denial of Service
• CVSS Score: 7.4 (High)
• Affected Products: Nexus 3000 and 9000 Series Switches
• Exploitation: Requires adjacent access
• Workarounds: None available

For leadership 🧭

Executive summary. Nexus 3000 and 9000 switches running IS-IS in standalone NX-OS mode can be forced to reload by a single crafted packet from anyone with Layer 2 adjacency, with no authentication required and no workaround beyond configuration changes. Given the high severity and the fact that a reload directly disrupts routing on affected switches, this should be scheduled for patching in the next available maintenance window.

Why it matters:

• The IS-IS process on Nexus 3000 and 9000 switches restarts and the device reloads when it receives a single malformed IS-IS packet, causing an outage on any network relying on that switch for routing.
• No authentication is needed and the attacker only needs Layer 2 adjacency, not valid credentials or prior access to the management plane.
• There are no workarounds; the only mitigation short of patching is enabling IS-IS area authentication, which reduces but does not eliminate exposure.
• Any switch with IS-IS enabled in standalone NX-OS mode is affected, so the blast radius extends to core and aggregation layers where IS-IS is commonly deployed.

Now / Next / Later:

• Now: Run ‘show running-config | include isis’ on all Nexus 3000 and 9000 switches to identify which ones have IS-IS enabled and are therefore exposed.
• Next: Upgrade affected switches to the first fixed NX-OS release for their train during the next change window, and enable IS-IS area authentication on any devices that cannot be patched immediately.
• Later: Add IS-IS area authentication as a standard baseline configuration for all IS-IS deployments and include Nexus NX-OS advisories in routine patch review cycles for switches carrying core routing protocols.