Remote Code Execution in Cisco NX-OS via NGOAM

Executive Summary

This vulnerability is in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, called NGOAM. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. The issue stems from improper input validation of IP traffic when NGOAM is enabled. An attacker could exploit this by sending crafted packets to an IP interface on the device, potentially leading to root-level code execution or device reloads.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to take full control of affected Cisco devices with root privileges. This could lead to unauthorized access, data breaches, or disruption of network services. Additionally, successful exploits may cause the device to crash and reload, resulting in downtime and potential loss of connectivity for critical systems.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the NGOAM feature on affected Cisco NX-OS devices if not required. Apply Cisco's official patch or update to the latest software version. Monitor network traffic for crafted packets targeting VXLAN OAM interfaces. Restrict access to device management interfaces and ensure proper network segmentation.

Useful 0 Not Useful 0