An unauthenticated, adjacent attacker can cause a denial of service on Cisco Nexus 9000 Series switches by sending a specifically crafted Ethernet frame to the management interface.

The vulnerability, categorized as CWE-805, stems from insufficient validation of Ethernet frames processed by the out-of-band management interface. An unauthenticated attacker positioned on the same local network segment can exploit this to force an unexpected device reload.

Successful exploitation results in an immediate denial of service, forcing the network switch to reload and interrupting all traffic passing through the fabric. With a CVSS score of 7.4, this vulnerability represents a high risk to network availability, potentially causing significant operational downtime for organizations relying on these switches for critical infrastructure connectivity.

Immediate Action: Update the Cisco NX-OS System Software to a patched release as specified in the official Cisco security advisory. Ensure that access to the out-of-band management interface is strictly restricted to authorized personnel and management networks.

Proactive Monitoring: Monitor device logs for unexpected reloads or system crashes that correlate with anomalous traffic patterns on the management interface. Review interface statistics for high volumes of malformed or unexpected Ethernet frames.

Compensating Controls: Implement strict Access Control Lists (ACLs) on the management network to limit exposure of the out-of-band management interface. Ensure that only trusted management stations have network-level access to the switch OOB port.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete service disruption, organizations should prioritize patching affected Nexus 9000 switches. While the attack requires proximity to the management network, the lack of authentication requirements makes this a significant risk to internal network stability. Please consult the Cisco security advisory referenced in the metadata for the specific software releases that address this buffer validation issue.