EUVD-2026-70201
GHSA-6g5h-4mv8-prv7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable listener on default-VRF ports with no user interaction and low complexity yields root code execution plus device reload, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.
This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.
AnalysisAI
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network (L3) reachability to TCP ports 43210 and 43211, which are open by default in the Layer 3 default VRF on affected Cisco Nexus 9000 switches running the Silicon One integration - no authentication, credentials, or user interaction are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H aligns with the description - network reachable, no authentication, no user interaction, and full compromise (root) plus device reload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed Cisco NX-OS release identified in Cisco advisory cisco-sa-n9k-s1-rce-EH8dEtr (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr); the input does not include an exact fixed version, so treat this as 'Patch available per vendor advisory' and pull the specific fixed build from that advisory rather than an invented version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a complete inventory of all Cisco Nexus 9000 Series Switches in production and identify versions running vulnerable NX-OS software; immediately implement emergency firewall and ACL rules to restrict network access to TCP ports 43210 and 43211 to trusted management networks only, and enable logging on all connection attempts to these ports. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nx Os Software
View allSame weakness CWE-1327 – Binding to an Unrestricted IP Address
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today