Cisco Nexus 3000 and 9000 Series Switches Intermediate System-to-Intermediate System Denial of Service Vulnerability

🚨SEVERITY: HIGH — CVSS 7.4Security Advisory

TL;DR 📌

  • A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due…
  • Highest CVSS: 7.4 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20241.

What it is

CVE-2025-20241 affects the IS-IS routing protocol implementation in Cisco NX-OS Software running on Nexus 3000 Series Switches and Nexus 9000 Series Switches in standalone NX-OS mode. The flaw is insufficient input validation when the switch parses an ingress IS-IS packet.

The attack path is Layer 2-adjacent and unauthenticated: an attacker does not need credentials on the device, but does need to be an IS-IS peer in the UP state on a segment where the protocol is enabled. Sending a crafted IS-IS packet to the switch causes the IS-IS process to restart unexpectedly, which can cause the whole device to reload — a denial of service rather than any compromise of data or configuration.

The vulnerability only matters where IS-IS is actually running. A switch is exposed if the feature isis and router isis configuration is present and at least one interface has ip router isis configured. Cisco notes that if IS-IS area authentication is enabled, an attacker would need a valid key to reach the vulnerable code path, since only established adjacencies can trigger it.

Cisco has confirmed this does not affect Nexus 9000 Series Fabric Switches in ACI mode, nor a list of other Firepower, MDS, Nexus 5000/6000/7000, Secure Firewall, and UCS Fabric Interconnect products — only standalone-mode Nexus 3000 and 9000 switches are in scope.

What to do

  • Check whether IS-IS is running: show running-config | include isis. If you see feature isis, router isis, and at least one ip router isis line, the device is exposed.
  • Identify active adjacencies with show isis adjacency to understand which peers could reach the vulnerable code path.
  • Cisco has released fixed software for this issue; the advisory does not list specific fixed version numbers here, so consult the Cisco advisory (cisco-sa-n39k-isis-dos-JhJA8Rfx) and the Nexus 3000/9000 Recommended Releases pages to identify the correct target release for your platform and train.
  • There is no workaround. As an interim mitigation, configure IS-IS area authentication so an attacker must pass authentication before they can trigger the flaw — this has been validated by Cisco in test but you should assess impact on your own network before deploying it.
  • This advisory is part of the August 2025 Cisco FXOS and NX-OS bundled publication; if you run Nexus 3000/9000 gear, review the other advisories in that bundle at the same time, since fixes are often shipped together.

For leadership 🧭

Executive summary. A crafted routing-protocol packet sent by a device sharing an IS-IS-enabled network segment can crash and reload a Nexus 3000 or 9000 switch running in standalone NX-OS mode, causing a network outage rather than data compromise. There is no workaround, so affected switches should be scheduled for the fixed software as part of the next change window.

Why it matters:

  • The attack requires only Layer 2 adjacency and no credentials, provided the attacker is an IS-IS peer in the UP state on a segment where the protocol is enabled — a plausible position for anyone with access to the same routed segment as the switch.
  • A successful crafted packet doesn’t just kill the IS-IS process; it can force the entire Nexus device to reload, taking down all traffic passing through that switch, not just routing updates.
  • Only Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode are affected — Nexus 9000 switches in ACI mode, and other Nexus, Firepower, MDS and UCS Fabric Interconnect products, are confirmed not vulnerable.
  • There is no workaround, only a mitigation (IS-IS area authentication), so exposure persists on unpatched, IS-IS-enabled devices until the fixed software is installed.

Now / Next / Later:

  • Now: Run show running-config | include isis on every Nexus 3000/9000 switch to confirm whether feature isis, router isis and ip router isis are configured, and use show isis adjacency to see which peers could trigger the flaw.
  • Next: Schedule the Cisco-provided fixed NX-OS release for affected Nexus 3000/9000 standalone switches during the next change window, checking the Recommended Releases pages for the correct target version per platform.
  • Later: Where IS-IS must stay enabled, configure IS-IS area authentication so only peers with a valid key can form adjacencies, and review the other advisories in the August 2025 Cisco FXOS/NX-OS bundle for the same hardware.

Source