CVE-2026-20212
Received Received - Intake

Remote Code Execution in Cisco Nexus 9000 Series Switches

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-20212
EUVD
EUVD-2026-70201

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cisco nexus_9000_series_switches *
cisco nexus_9000_series_switches to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1327 The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical remote code execution vulnerability in Cisco Nexus 9000 Series Switches with Silicon One ASIC. It exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 VRF, allowing unauthenticated remote attackers to execute arbitrary code with root privileges. Successful exploitation could also crash the S1HAL process, causing the device to reload.

Detection Guidance

To detect this vulnerability, check if TCP ports 43210 and 43211 are open and accessible on your Cisco Nexus 9000 Series Switches. Use network scanning tools like nmap to scan for these ports. Example command: nmap -p 43210,43211 <target_IP>. If these ports are open, the device may be vulnerable.

Impact Analysis

An attacker could gain full control of affected Cisco Nexus 9000 Series Switches, execute arbitrary commands with root privileges, and potentially cause the device to crash and reload. This could lead to network disruption, unauthorized access to network traffic, and compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately block unauthorized access to TCP ports 43210 and 43211 using infrastructure access control lists (iACLs). Apply Cisco's recommended software updates to affected devices. Use Cisco's Live Protect shield for temporary protection until updates are deployed. Verify affected software versions using the Cisco Software Checker.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart