Cisco NX-OS Software contains a critical remote code execution vulnerability that allows an unauthenticated attacker to gain full root-level control over affected Nexus 9000 Series Switches.

This vulnerability, classified as CWE-1327, stems from the exposure of TCP ports 43210 and 43211 in the default Layer 3 virtual routing and forwarding instance, permitting unauthenticated remote attackers to inject crafted input that executes as root-level code.

The potential for unauthenticated remote code execution with root privileges represents a catastrophic security failure, as it grants an attacker complete control over the network infrastructure device. Given the CVSS score of 9.8, this vulnerability poses an extreme risk of data interception, lateral movement within the network, and total service disruption, including the potential for permanent device reloading or denial of service.

Immediate Action: Apply the vendor-supplied security update provided in the Cisco security advisory (cisco-sa-n9k-s1-rce-EH8dEtr) to all affected Nexus 9000 Series Switches immediately.

Proactive Monitoring: Monitor network traffic for unauthorized connections attempting to communicate with TCP ports 43210 and 43211 and review system logs for unexpected S1HAL process crashes.

Compensating Controls: Utilize Access Control Lists or firewall rules to restrict network access to the management interfaces and specifically block external traffic attempting to reach the vulnerable TCP ports.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this vulnerability and the ability for unauthenticated remote attackers to achieve root-level code execution, organizations must prioritize patching these devices. Please verify all affected hardware versions against the vendor advisory and schedule an emergency maintenance window if immediate patching is not possible.