A Critical Flaw in Nexus Switches Puts Data Centers at Risk
Cybersecurity experts are sounding the alarm after Cisco released five critical vulnerability advisories for its NX-OS data center network operating system. The flaws, which allow attackers to run arbitrary code with root privileges on Nexus switches, could have far-reaching consequences if left unpatched.
The affected devices include Nexus 3000 and Nexus 9000 Series switches, which are widely used in data centers and enterprise networks. According to Cisco’s advisory, the vulnerabilities can be exploited through various means, including crafted HTTP requests sent to the NX-API feature or malicious packets sent to an IP interface with NGOAM enabled.
The issues all stem from a validation failure that requires at least one of three features – NX-API, Next Generation OAM (NGOAM), and MPLS OAM – to be active on the affected device. If exploited successfully, attackers could gain root access to the switch, allowing them to execute arbitrary code or even take control of the device.
The five vulnerabilities have been assigned CVE numbers and have varying levels of severity, with one rated as a CVSS 10.0 score, indicating a high risk of exploitation. The affected features are disabled by default in most cases, but Cisco recommends disabling them altogether if not needed to eliminate the attack vector.
Cisco has issued temporary Live Protect shields for all five flaws, which can be applied to switches that cannot yet be upgraded and rebooted. However, upgrading to a fixed NX-OS release is still the recommended course of action. The vendor’s Software Checker tool can help identify affected releases and guide users through the upgrade process.
It’s worth noting that Nexus 7000 switches and Nexus 9000 switches operating in ACI mode are not affected by these vulnerabilities. However, for those using other versions of Nexus switches, patching is essential to prevent potential attacks.
In addition to the five Nexus flaws, Cisco also released security hardening updates for its License (formerly Smart Software Manager) product, addressing issues such as missing authentication and improper cryptographic signature verification.
To mitigate these risks, users should prioritize upgrading their NX-OS releases to a fixed version. If this is not possible immediately, disabling unnecessary features can help reduce the attack surface. It’s also crucial to regularly review system configurations and ensure that only necessary features are enabled.
In conclusion, the recent Cisco advisories highlight the importance of regular security updates and patching in preventing potential attacks on critical infrastructure. By taking proactive measures to address these vulnerabilities, organizations can minimize their exposure to threats and maintain a secure network environment.
Source: Bleeping Computer — 2026-10-08