Multiple critical vulnerabilities have been identified in Cisco’s Nexus 3000 and Nexus 9000 series switches that affect the Cisco OS’s Next Generation Operations, Administration, and Maintenance (NGOAM) feature.

In this blog, we break down the critical flaws in Cisco’s Nexus 3000 and Nexus 9000 series, their impact on organizations, and what organizations can do to mitigate them.

About the vulnerability

What can attackers do with the vulnerabilities?

An unauthenticated remote attacker can exploit the vulnerabilities to:

• Execute arbitrary code with root privileges.
• Crash processes, force reloads, and cause denial-of-service (DoS).
• Cause a compromise of the device and gain extensive control over the affected network switches to further malicious activity.
• Disrupt network operations through denial-of-service conditions.

Official mitigation guidance

Upgrade the affected Cisco NX-OS software to the applicable fixed release for the specific Nexus switch model and installed NX-OS version. If NGOAM is not required, disable the feature using no feature NGOAM.

SharkStriker’s recommendations

• Identify all Cisco Nexus 3000 and Nexus 9000 Series switches running affected NX-OS versions.
• Verify whether Next Generation Operations, Administration, and Maintenance (NGOAM) is enabled.
• Upgrade affected switches to the applicable Cisco NX-OS fixed release as soon as possible.
• Disable NGOAM if it is not required.
• Apply Cisco Live Protect shields where applicable until the software update can be deployed.