Remote Code Execution in Cisco NX-OS SRv6 NGOAM

Executive Summary

This vulnerability affects Cisco NX-OS Software's Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an affected device.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the NGOAM feature is enabled on Cisco NX-OS devices. Use the command 'show ngoam status' to verify if NGOAM is active. If enabled, inspect network traffic for crafted packets targeting SRv6 interfaces. Monitor device logs for crashes or reloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of your network device, execute malicious code, or crash the system causing downtime. This could disrupt network operations and expose sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution with root privileges, potentially allowing attackers to access, modify, or exfiltrate sensitive data. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited on systems handling such data.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the NGOAM and SRv6 features on affected Cisco NX-OS devices if not required. Apply the latest security patches from Cisco as soon as they become available. Monitor network traffic for unusual activity targeting IP interfaces. Restrict access to network devices using firewalls and access control lists.

Useful 0 Not Useful 0