Description
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco NX-OS Software | 9.2(3); 9.2(2v); 9.2(1); 9.2(2t); 9.2(3y); 9.3(2); 9.2(4); 9.3(1); 9.3(1z); 9.2(2); 9.3(3); 9.3(4); 9.3(5); 9.3(6); 9.3(5w); 9.3(7); 9.3(7k); 9.3(7a); 9.3(8); 9.3(9) |
| Cisco | Cisco Unified Computing System (Managed) | 4.0(1a); 4.1(1d); 4.0(4f); 4.0(4a); 4.0(4e); 4.0(4c); 4.0(4h); 4.1(1c); 4.0(2a); 4.1(1e); 4.1(2a); 4.0(2b); 4.0(1b); 4.0(4d); 4.0(2e); 4.1(1a); 4.0(4g); 4.0(1c); 4.0(1d); 4.0(4b) |
References
Timeline
- Published
- Oct 7, 2026
- Last modified
- Oct 8, 2026
- NVD status
- Awaiting Analysis