Cisco Nexus 3000 & 9000 Vulnerability Enables DoS Attacks

Cisco has issued a high-severity advisory about a vulnerability in its Nexus 3000 and 9000 Series switches that could allow attackers to trigger denial of service via crafted IS-IS packets. The flaw, tracked as CVE-2025-20241, carries a CVSS v3.1 base score of 7.4 and affects the IS-IS feature in NX-OS Software on Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode, with the issue stemming from insufficient input validation when parsing incoming IS-IS packets.

An unauthenticated attacker adjacent to the network (Layer 2-adjacent) can exploit this weakness by sending specially crafted IS-IS packets, potentially causing the IS-IS process to restart and the entire device to reload. Cisco confirms the vulnerability can only be exploited by an adjacent IS-IS peer in the UP state, and, if IS-IS authentication is enabled, attackers would also need valid authentication keys.

Software updates addressing the vulnerability have been released, and immediate patching is strongly recommended, with IS-IS area authentication suggested as a best-practice mitigation. The timing of the disclosure, as part of the August 2025 advisory bundle, underscores the need for organisations to assess exposure and plan remediation promptly.