Cisco has issued security patches to fix a critical vulnerability impacting 10 Silicon One-based Nexus 9000 switches that could permit an unauthorized, remote threat actor to execute code with root privileges.
About the flaw
This flaw arises because the default Layer 3 (L3) virtual routing and forwarding (VRF) allows access to TCP ports 43210 and 43211. If the exploit is effective, the attacker may be able to connect to the compromised device and submit manipulated input that could be run as root-level code. Additionally, if this vulnerability is exploited, the S1HAL process may crash and the device may need to reload.
Who is impacted?
The Nexus vulnerability, tracked as CVE-2026-20212, with a CVSS score of 9.8, was reported on September 2 by Cisco. The vulnerability impacts a few Nexus 9000 switches consisting of Silicon One ASICs, which can result in either device outages or remote code execution.
According to Cisco, Nexus 9000 Series Switches with the following product identifiers (PIDs) included a Silicon One ASIC, are vulnerable:
- N9324C-SE1U
- N9348Y2C6D-SE1U
- N9364E-SG2-O
- N9364E-SG2-Q
- N9396T12C-SE1
- N9348Y12C-SE1
- N9396Y12C-SE1
- N9336C-SE1
- N9K-C9804
- N9K-C9808
If effectively abused, the threat actor could run code with root-level privileges on the switch, This can allow attackers to modify the device, compromise traffic travelling via the infrastructure, and disturb the network operations.
According to Cisco, Nexus 9000 switches working in ACI mode and other Cisco and Nexus product families are not impacted. Admins can use the show module command to find the product ID of a Nexus switch and decide if it is in the impacted range.
The following products are not vulnerable, according to Cisco advisory:
- Firepower 1000 Series
- Firepower 2100 Series
- Firepower 4100 Series
- Firepower 9300 Security Appliances
- MDS 9000 Series Multilayer Switches
- Nexus 3000 Series Switches
- Nexus 7000 Series Switches
- Nexus 9000 Series Switches other than the models listed in the Vulnerable Products section
- Nexus 9000 Series Fabric Switches in ACI mode
- Secure Firewall 200 Series
- Secure Firewall 1200 Series
- Secure Firewall 3100 Series
- Secure Firewall 4200 Series
- Secure Firewall 6100 Series
- UCS 6300 Series Fabric Interconnects
- UCS 6400 Series Fabric Interconnects
- UCS 6500 Series Fabric Interconnects
- UCS 6600 Series Fabric Interconnects
- UCS X-Series Direct Fabric Interconnect 9108 100G
Cisco has launched software updates to patch the flaw. It has also advised customers to upgrade to a fixed NX-OS release. Cisco has also launched a Live Protect Shield as a temporary fix for impacted executions, but urges that it is only temporary until a complete software upgrade is available.
Read the original article: