Skip to content
OpenAdvisories
High NCSC-2025-0287 7 CVEs

Kwetsbaarheden verholpen in Cisco NX-OS Software

Published Sep 11, 2025 · Updated Sep 11, 2025 · nl

Vendor: Cisco Product: Data Center Network Manager Product: MDS 9000 Multilayer Directors and Fabric Switches Product: Nexus Product: Nexus 1000V Series Switches Product: Nexus 3000 Series Switches Product: Nexus 5000 Series Switches Product: Nexus 7000 Series Switches Product: Nexus 9000 Series Switches Product: Nexus Dashboard Product: Nexus Dashboard Fabric Controller Product: NX-OS Product: NX-OS Software Product: NX-OS System Software in ACI Mode Product: nx-os_aci_mode Product: Unified Computing System (Managed) Product: Unified Computing System (UCS)

Summary

Cisco heeft kwetsbaarheden verholpen in Cisco NX-OS Software voor Nexus 3000 en 9000 Series Switches.

Details

Interpretaties
De kwetsbaarheden bevinden zich in verschillende functies van de Cisco NX-OS Software, waaronder IS-IS, PIM6, logging, command-line interface (CLI), en de REST API van de Nexus Dashboard. Deze kwetsbaarheden kunnen worden misbruikt door zowel geauthenticeerde als niet-geauthenticeerde aanvallers om Denial-of-Service (DoS) te veroorzaken, ongeautoriseerde toegang tot gevoelige informatie te verkrijgen, en zelfs rootprivileges op de apparaten te verkrijgen. De ernst van deze kwetsbaarheden vereist onmiddellijke aandacht van beveiligingsbeheerders die deze apparaten beheren.

Oplossingen
Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • High 7.4
    CVE-2025-20241

    Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol <TBD> Denial of Service Vulnerability

    A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to c…

    Cisco Cisco NX-OS Software Network devices
  • Medium 6.5
    CVE-2025-20344

    Cisco Nexus Dashboard Path Traversal Vulnerability

    A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This vulnerability is due to insufficient validation of the contents of a back…

    Cisco Cisco Nexus Dashboard Network devices
  • Medium 5.5
    CVE-2025-20290

    Cisco NXOS Software Sensitive Log Information Disclosure Vulnerability

    A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nexus 9000 Series Switches in standalone NX-OS mode, Cisco UCS 6400 Fabric Interconnects, Cisco UCS 6500 Series Fabric Interconnects, and Cisco UCS 9108…

    Cisco Cisco NX-OS Software Cisco Unified Computing System (Managed) Network devices
  • Medium 5.4
    CVE-2025-20347

    Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

    A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device.…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.0
    CVE-2025-20262

    Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability

    A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash o…

    Cisco Cisco NX-OS Software Network devices
  • Medium 5.0
    CVE-2025-20348

    Cisco Nexus Dashboard Unauthorized REST API Vulnerability

    A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device.…

    Cisco Cisco Nexus Dashboard Network devices
  • Medium 4.4
    CVE-2025-20292

    Cisco NXOS Software Command Injection Vulnerability

    A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid user cr…

    Cisco Cisco NX-OS Software Cisco Unified Computing System (Managed) Cisco NX-OS System Software in ACI Mode Network devices

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n39k-isis-dos-JhJA8Rfx
  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-ptrs-XU2Fm2Wb
  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nshs-urapi-gJuBVFpu
  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-qhNze5Ss
  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-infodis-TEcTYSFG
  • Reference
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxospc-pim6-vG4jFPh