CVE-2025-20262
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-27

Last updated on: 2025-08-29

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-27
Last Modified
2025-08-29
Generated
2026-06-16
AI Q&A
2025-08-27
EPSS Evaluated
2026-06-15
NVD
CVE-2025-20262
EUVD
EUVD-2025-27687
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
cisco nexus_9000 *
cisco nexus_3000 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects the Protocol Independent Multicast Version 6 (PIM6) feature on Cisco Nexus 3000 and 9000 Series Switches running standalone NX-OS. It occurs because of improper processing of PIM6 ephemeral data queries. An authenticated, low-privileged remote attacker can send specially crafted ephemeral queries via interfaces like NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry to cause the PIM6 process to crash and restart. This leads to adjacency flaps and disruption of PIM6 and ephemeral query operations, resulting in a denial of service (DoS). [1]

Impact Analysis

Exploitation of this vulnerability can cause the PIM6 process on affected Cisco Nexus switches to crash and restart, leading to adjacency flaps and disruption of multicast routing and ephemeral query processes. This results in a denial of service (DoS) condition, potentially impacting network availability and stability for multicast traffic relying on PIM6. [1]

Detection Guidance

You can detect if your device is potentially vulnerable by verifying if the PIM6 feature and any of the following features are enabled: NX-API, NETCONF, RESTCONF, gRPC, or Model Driven Telemetry. Use the CLI commands `show feature | include pim6` to check for PIM6 and `show feature | include <feature_name>` to check for the other features. If these features are enabled on Cisco Nexus 3000 or 9000 Series Switches in standalone NX-OS mode, the device may be vulnerable. [1]

Mitigation Strategies

The immediate mitigation step is to upgrade to the fixed software releases provided by Cisco as recommended in their security advisories. There are no workarounds available. Ensure hardware and software compatibility before upgrading. Use Cisco's Software Checker tool to identify vulnerable software versions and obtain the appropriate fixed releases. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-20262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart