Product: Cisco NX-OS Software for Cisco Nexus 3000 and 9000 Series Switches
Summary
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, leading to a denial of service (DoS) condition. This issue arises from insufficient input validation when parsing an ingress IS-IS packet. An attacker must be Layer 2-adjacent to the affected device to exploit this vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.4 | CVE-2025-20241 |
Exploitation
To exploit this vulnerability, an attacker must send a crafted IS-IS packet to an affected device while being Layer 2-adjacent. This crafted packet can trigger an unexpected restart of the IS-IS process, causing the device to reload and resulting in a denial of service.
Affected Products
- Cisco Nexus 3000 Series Switches: These switches may experience unexpected restarts of the IS-IS process due to the vulnerability.
- Cisco Nexus 9000 Series Switches: Similar to the Nexus 3000, these switches are also affected and can be exploited in the same manner.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest patches provided by Cisco for the affected NX-OS Software. Additionally, network segmentation and monitoring can help reduce the risk of exploitation by limiting access to Layer 2-adjacent attackers.