Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability

Vulnerability

The vulnerability resides in the NX-API feature of Cisco NX-OS Software. Due to incorrect input validation, a crafted HTTP or HTTPS request can trigger a buffer overflow. Affected platforms include MDS 9000 Series (prior to 8.1(1)), Nexus 3000 (prior to 7.0(3)I4(8) and 7.0(3)I7(1)), Nexus 3500 (prior to 6.0(2)A8(8)), Nexus 3600 (prior to 7.0(3)F3(5)), Nexus 2000/5500/5600/6000 (prior to 7.3(2)N1(1)), Nexus 7000/7700 (prior to 7.3(3)D1(1)), Nexus 9000 Standalone (prior to 7.0(3)I4(8) and 7.0(3)I7(1)), and Nexus 9500 R-Series (prior to 7.0(3)F3(5)). The NX-API feature is disabled by default.

Exploitation

An attacker must have authenticated local access to the device and the NX-API feature must be enabled. The attacker sends a specially crafted HTTP or HTTPS request to an internal service on the device. The request exploits the input validation flaw to cause a buffer overflow, leading to arbitrary code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges, resulting in full compromise of the affected device. This includes complete control over the system, data access, and potential for further network attacks.

Mitigation

Cisco has released free software updates to address this vulnerability. Affected users should upgrade to the fixed versions as specified in the advisory [1]. As a workaround, if NX-API is not required, it should be disabled. No other workarounds are mentioned. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.