Cisco NX-OS Software Command Injection Vulnerability
TL;DR 📌
- A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. This vulnerability is due to insufficient validation of user-supplied input.…
- Highest CVSS: 4.4 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20292.
What it is
CVE-2025-20292 is a command injection vulnerability in the CLI of Cisco NX-OS Software. It arises from insufficient validation of user-supplied input when that input is passed as an argument to an affected CLI command.
Exploitation requires an authenticated, local attacker — valid user credentials on the device are needed, and the attack is delivered via the CLI rather than over the network or through an unauthenticated management interface. There is no remote, credential-free path described for this flaw.
A successful exploit lets the attacker read and write files on the underlying operating system, but only with the privileges of a non-root user account. File system access is bounded by whatever permissions that non-root account already holds, so this is a privilege-boundary and file-access issue within the CLI, not a route to root or full device compromise on its own.
The affected products span a wide range of Cisco data-centre switching and fabric hardware: MDS 9000 Series switches, Nexus 1000V Edge, Nexus 3000, 5500, 5600, 6000, 7000, and 9000 Series (both standalone NX-OS and ACI mode), plus UCS 6400 and 6500 Series Fabric Interconnects and the UCS X-Series Direct Fabric Interconnect 9108 100G. Firepower 1000/2100/4100/9300, Secure Firewall 3100/4200, and UCS 6300 Series Fabric Interconnects are confirmed not affected. This advisory is part of Cisco’s August 2025 semiannual FXOS and NX-OS bundled publication.
What to do
- Treat this as a lower-urgency item given the CVSS score of 4.4 (medium) and the local, authenticated access requirement — but don’t ignore it if your environment has broad CLI access among operators or automation accounts.
- There are no workarounds; the only remediation is upgrading NX-OS. Fixed releases given in the advisory include 4.2(3p) (for 4.2), 4.3 (for 4.2(3p)), and 4.3(6.250048) (for 4.3(6a)) — check which mapping applies to your current train and confirm against the Cisco Software Checker for your exact platform and release, since the fixed-release list varies by product family.
- Use the Cisco Software Checker tool referenced in the advisory to confirm your specific device/release combination and get the “First Fixed” or “Combined First Fixed” version for your bundle of applicable advisories.
- Review who holds valid CLI credentials on affected switches and fabric interconnects (MDS 9000, Nexus 1000V/3000/5500/5600/6000/7000/9000, UCS 6400/6500, UCS X-Series 9108 100G) — since exploitation depends on an authenticated local account, tightening credential issuance and CLI access reduces exposure ahead of patching.
- Confirm hardware and current software configurations will be supported on the target release before upgrading, and check with Cisco TAC or your maintenance provider if that’s unclear.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 4.2 | 4.2(3p) |
| 4.2(3p) | 4.3 |
| 4.3(6a) | 4.3(6.250048) |
For leadership 🧭
Executive summary. This flaw needs valid device credentials to exploit, so it is not an internet-facing risk, but any operator or automation account with CLI access to affected Nexus, MDS or UCS fabric gear could read or write files beyond their intended CLI scope. There is no workaround, so remediation depends entirely on scheduling the NX-OS upgrade during a normal change window rather than emergency action.
Why it matters:
- Affects a broad swathe of data-centre switching hardware: MDS 9000, Nexus 1000V/3000/5500/5600/6000/7000/9000 (standalone and ACI mode), and UCS 6400/6500/X-Series 9108 100G fabric interconnects.
- Exploitation happens through crafted arguments to an affected CLI command, so any account with CLI login — human or automation/service account — is a potential vector, not just admins.
- Impact is bounded by the non-root account’s existing file permissions, so this is a boundary-crossing and file-tampering issue on the underlying OS rather than a path to root or full device takeover.
- No workaround exists, so exposure persists on unpatched trains until the NX-OS image itself is upgraded.
Now / Next / Later:
- Now: Inventory which of the affected platforms (MDS 9000, Nexus 1000V/3000/5500/5600/6000/7000/9000, UCS 6400/6500/X-Series 9108 100G) are running in your estate and check current NX-OS release against the Cisco Software Checker.
- Next: Schedule the NX-OS upgrade to the appropriate fixed release for each platform (e.g. 4.2(3p), 4.3, or 4.3(6.250048) depending on your current train) during a normal maintenance window, verifying hardware and configuration support first.
- Later: Review and tighten who holds valid CLI credentials on affected switches and fabric interconnects, including automation and service accounts, to reduce the pool of accounts that could trigger this class of CLI input-validation issue in future.