Cisco Warns of High-Severity DoS Flaw (CVE-2025-20241) in Nexus Switches

According to Cisco Systems, a high-severity denial-of-service vulnerability (CVE-2025-20241) affects Cisco Nexus 3000 and 9000 Series Switches running NX-OS software, with a CVSS of 7.4. The flaw arises from insufficient input validation when parsing IS-IS packets, allowing an unauthenticated, adjacent attacker to cause the IS-IS process to crash and the device to reload.

Exploitation is limited to attackers with Layer 2 adjacency to the targeted device, and the advisory notes that this can only be exploited by an adjacent IS-IS peer in the UP state, with IS-IS authentication requiring a valid key to exploit if enabled. The vulnerability affects only devices with IS-IS routing enabled, and Cisco has released free software updates to patch it. Organisations unable to upgrade immediately are advised to enable IS-IS authentication with strong keys to reduce risk. Nexus 3000 and 9000 switches should have patches applied and IS-IS configurations reviewed to harden defenses.