Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability

🚨SEVERITY: MEDIUM — CVSS 5.0Security Advisory

TL;DR 📌

  • A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition. This vulnerability is due to…
  • Highest CVSS: 5.0 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20262.

What it is

CVE-2025-20262 affects the PIM6 (Protocol Independent Multicast Version 6) feature on Cisco Nexus 3000 Series Switches and Nexus 9000 Series Switches running in standalone NX-OS mode. The flaw is in how PIM6 handles ephemeral data queries.

To reach it, an attacker needs an authenticated, low-privileged session and network access to one of several management-plane interfaces: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A crafted ephemeral query sent through any of these causes the PIM6 process to crash and restart. This can cause PIM6 adjacency flaps and a denial of service affecting both PIM6 and ephemeral query processing on the device.

Two conditions must both be true for a device to be exposed: the PIM6 feature must be enabled, and at least one of the listed management interfaces (NX-API, NETCONF, RESTCONF, gRPC, telemetry) must also be enabled. All of these are disabled by default. PIM4 is explicitly not affected. Nexus 9000 switches running in ACI mode are not affected either — only standalone NX-OS mode is in scope.

This is a data/control-plane process crash rather than a compromise: there’s no indication of code execution or privilege escalation, only disruption of multicast routing continuity while PIM6 restarts.

What to do

  • Check exposure first: run show feature | include pim6 to confirm PIM6 is enabled, then check each of nxapi, netconf, restconf, grpc, and telemetry with the same show feature | include <name> pattern. A device is only affected if PIM6 and at least one of those is enabled.
  • There is no workaround — Cisco has released software updates. Use the Cisco Software Checker against your current release to get the exact “First Fixed” version for this advisory (cisco-sa-nxospc-pim6-vG4jFPh).
  • If you can’t patch immediately and PIM6 isn’t required, disabling it removes the exposure; alternatively, disabling the unused management interfaces (NX-API, NETCONF, RESTCONF, gRPC, telemetry) closes the access path even with PIM6 running.
  • Restrict access to management-plane services (NX-API, NETCONF, RESTCONF, gRPC, telemetry) to trusted management networks only, since exploitation requires reaching one of these interfaces.
  • This advisory is part of the August 2025 Cisco FXOS and NX-OS bundled publication — worth checking the other advisories in that bundle if you run the same platforms, in case further action is needed.

For leadership 🧭

Executive summary. Nexus 3000 and 9000 switches running standalone NX-OS with PIM6 and a management API (NX-API, NETCONF, RESTCONF, gRPC or telemetry) enabled can have their PIM6 process crashed by an authenticated low-privileged user, causing a multicast routing outage. There’s no code execution risk, so this can be scheduled through normal patch and change-control processes rather than treated as an emergency.

Why it matters:

  • Exploitation requires both PIM6 and one of NX-API, NETCONF, RESTCONF, gRPC or Model Driven Telemetry to be enabled — all disabled by default, so exposure is limited to switches deliberately configured for programmability or multicast IPv6 routing.
  • A crafted ephemeral data query crashes and restarts the PIM6 process, which can flap PIM6 adjacencies and disrupt multicast forwarding on the affected switch until it recovers.
  • No workaround exists — the only fix is a software upgrade, so any exposed device stays exposed until patched or reconfigured.
  • Nexus 9000 switches in ACI mode and the PIM4 feature are unaffected, so the exposure is specific to standalone NX-OS mode with IPv6 multicast in use.

Now / Next / Later:

  • Now: Run show feature | include pim6 and then check nxapi, netconf, restconf, grpc and telemetry the same way on every Nexus 3000/9000 switch to identify which devices have both PIM6 and a vulnerable management interface enabled.
  • Next: For confirmed-exposed switches, use the Cisco Software Checker against the current release to identify the first fixed NX-OS version and schedule the upgrade in your next change window; where patching must wait, disable PIM6 if unused or restrict the affected management interfaces to trusted management networks.
  • Later: Limit NX-API, NETCONF, RESTCONF, gRPC and telemetry access to dedicated management network segments by default, and review the other advisories in the August 2025 Cisco FXOS and NX-OS bundle for the same platforms.

Source