CVE-2026-20051
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Platforms could allow an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop.
This vulnerability is due to a logic error when processing a crafted Layer 2 ingress frame. An attacker could exploit this vulnerability by sending a stream of crafted Ethernet frames through the targeted device. A successful exploit could allow the attacker to cause a Layer 2 Virtual eXtensible LAN (VxLAN) traffic loop, which, in turn, could result in a denial of service (DoS) condition. This Layer 2 loop could oversubscribe the bandwidth on network interfaces, which would result in all data plane traffic being dropped. To exploit this vulnerability, the attacker must be Layer 2-adjacent to the affected device. Note: To stop active exploitation of this vulnerability, manual intervention is required to both stop the crafted traffic and flap all involved network interfaces. For additional assistance if a Layer 2 loop that is related to this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or the proper support provider.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco NX-OS Software | 9.2(3) | affected |
| Cisco | Cisco NX-OS Software | 9.2(2v) | affected |
| Cisco | Cisco NX-OS Software | 9.2(1) | affected |
| Cisco | Cisco NX-OS Software | 9.2(2t) | affected |
| Cisco | Cisco NX-OS Software | 9.2(3y) | affected |
| Cisco | Cisco NX-OS Software | 9.3(2) | affected |
| Cisco | Cisco NX-OS Software | 9.2(4) | affected |
| Cisco | Cisco NX-OS Software | 9.3(1) | affected |
| Cisco | Cisco NX-OS Software | 9.3(1z) | affected |
| Cisco | Cisco NX-OS Software | 9.2(2) | affected |
| Cisco | Cisco NX-OS Software | 9.3(3) | affected |
| Cisco | Cisco NX-OS Software | 9.3(4) | affected |
| Cisco | Cisco NX-OS Software | 9.3(5) | affected |
| Cisco | Cisco NX-OS Software | 9.3(6) | affected |
| Cisco | Cisco NX-OS Software | 9.3(5w) | affected |
| Cisco | Cisco NX-OS Software | 9.3(7) | affected |
| Cisco | Cisco NX-OS Software | 9.3(7k) | affected |
| Cisco | Cisco NX-OS Software | 10.2(1) | affected |
| Cisco | Cisco NX-OS Software | 9.3(7a) | affected |
| Cisco | Cisco NX-OS Software | 9.3(8) | affected |
| Cisco | Cisco NX-OS Software | 10.2(1q) | affected |
| Cisco | Cisco NX-OS Software | 10.2(2) | affected |
| Cisco | Cisco NX-OS Software | 9.3(9) | affected |
| Cisco | Cisco NX-OS Software | 10.2(3) | affected |
| Cisco | Cisco NX-OS Software | 10.2(3t) | affected |
| Cisco | Cisco NX-OS Software | 9.3(10) | affected |
| Cisco | Cisco NX-OS Software | 10.2(2a) | affected |
| Cisco | Cisco NX-OS Software | 10.3(1) | affected |
| Cisco | Cisco NX-OS Software | 10.2(4) | affected |
| Cisco | Cisco NX-OS Software | 10.3(2) | affected |
| Cisco | Cisco NX-OS Software | 9.3(11) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3) | affected |
| Cisco | Cisco NX-OS Software | 10.2(5) | affected |
| Cisco | Cisco NX-OS Software | 9.3(12) | affected |
| Cisco | Cisco NX-OS Software | 10.2(3v) | affected |
| Cisco | Cisco NX-OS Software | 10.4(1) | affected |
| Cisco | Cisco NX-OS Software | 10.2(6) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3w) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3o) | affected |
| Cisco | Cisco NX-OS Software | 10.3(4) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3p) | affected |
| Cisco | Cisco NX-OS Software | 10.3(4a) | affected |
| Cisco | Cisco NX-OS Software | 10.4(2) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3q) | affected |
| Cisco | Cisco NX-OS Software | 9.3(13) | affected |
| Cisco | Cisco NX-OS Software | 10.3(5) | affected |
| Cisco | Cisco NX-OS Software | 10.2(7) | affected |
| Cisco | Cisco NX-OS Software | 10.4(3) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3x) | affected |
| Cisco | Cisco NX-OS Software | 10.3(4g) | affected |
| Cisco | Cisco NX-OS Software | 10.5(1) | affected |
| Cisco | Cisco NX-OS Software | 10.2(8) | affected |
| Cisco | Cisco NX-OS Software | 10.3(3r) | affected |
| Cisco | Cisco NX-OS Software | 10.3(6) | affected |
| Cisco | Cisco NX-OS Software | 9.3(14) | affected |
| Cisco | Cisco NX-OS Software | 10.4(4) | affected |
| Cisco | Cisco NX-OS Software | 10.3(4h) | affected |
| Cisco | Cisco NX-OS Software | 10.5(2) | affected |
| Cisco | Cisco NX-OS Software | 10.3(7) | affected |
| Cisco | Cisco NX-OS Software | 10.4(5) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3) | affected |
| Cisco | Cisco NX-OS Software | 10.2(9) | affected |
| Cisco | Cisco NX-OS Software | 9.3(15) | affected |
| Cisco | Cisco NX-OS Software | 10.4(4g) | affected |
| Cisco | Cisco NX-OS Software | 10.5(4) | affected |
| Cisco | Cisco NX-OS Software | 10.6(1) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3t) | affected |
| Cisco | Cisco NX-OS Software | 10.3(8) | affected |
| Cisco | Cisco NX-OS Software | 10.4(6) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3s) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3e) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3o) | affected |
| Cisco | Cisco NX-OS Software | 9.3(16) | affected |
| Cisco | Cisco NX-OS Software | 10.6(1s) | affected |
| Cisco | Cisco NX-OS Software | 10.5(3p) | affected |
Weaknesses
- CWE-457: Use of Uninitialized Variable
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.