A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an unexpected reload of the device. This vulnerability is due to incorrect error checking when parsing ingress LLDP packets. An attacker could exploit this vulnerability by sending a steady stream of crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause a memory leak, which could result in a denial of service (DoS) condition when the device unexpectedly reloads. Note: This vulnerability cannot be exploited by transit traffic through the device. The crafted LLDP packet must be targeted to a directly connected interface, and the attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). In addition, the attack surface for this vulnerability can be reduced by disabling LLDP on interfaces where it is not required.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco NX-OS System Software in ACI Mode affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:cisco:nx-os:15.2\(1g\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(2e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(2f\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(2g\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(2h\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(3e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(3f\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(3g\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(4d\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(4e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(4f\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(5c\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(5d\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:15.2\(5e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:16.0\(1g\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:16.0\(1j\):*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:nexus_9000v:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-ex-24:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-fx-24:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9316d-gx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-ex-24:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-fx-24:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-fx3s:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9332d-gx2b:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9348d-gx2a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93600cd-gx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9364d-gx2a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9372px-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9372tx-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9408:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9808:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Nexus 9000v Subscribe
Nexus 92160yc-x Subscribe
Nexus 92300yc Subscribe
Nexus 92304qc Subscribe
Nexus 92348gc-x Subscribe
Nexus 9236c Subscribe
Nexus 9272q Subscribe
Nexus 93108tc-ex Subscribe
Nexus 93108tc-ex-24 Subscribe
Nexus 93108tc-fx Subscribe
Nexus 93108tc-fx-24 Subscribe
Nexus 93108tc-fx3p Subscribe
Nexus 93120tx Subscribe
Nexus 93128tx Subscribe
Nexus 9316d-gx Subscribe
Nexus 93180lc-ex Subscribe
Nexus 93180yc-ex Subscribe
Nexus 93180yc-ex-24 Subscribe
Nexus 93180yc-fx Subscribe
Nexus 93180yc-fx-24 Subscribe
Nexus 93180yc-fx3 Subscribe
Nexus 93180yc-fx3s Subscribe
Nexus 93216tc-fx2 Subscribe
Nexus 93240yc-fx2 Subscribe
Nexus 9332c Subscribe
Nexus 9332d-gx2b Subscribe
Nexus 9332pq Subscribe
Nexus 93360yc-fx2 Subscribe
Nexus 9336c-fx2 Subscribe
Nexus 9336c-fx2-e Subscribe
Nexus 9336pq Aci Spine Subscribe
Nexus 9348d-gx2a Subscribe
Nexus 9348gc-fxp Subscribe
Nexus 93600cd-gx Subscribe
Nexus 9364c Subscribe
Nexus 9364c-gx Subscribe
Nexus 9364d-gx2a Subscribe
Nexus 9372px Subscribe
Nexus 9372px-e Subscribe
Nexus 9372tx Subscribe
Nexus 9372tx-e Subscribe
Nexus 9396px Subscribe
Nexus 9396tx Subscribe
Nexus 9408 Subscribe
Nexus 9508 Subscribe
Nexus 9808 Subscribe
Nx-os Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24268 A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an unexpected reload of the device. This vulnerability is due to incorrect error checking when parsing ingress LLDP packets. An attacker could exploit this vulnerability by sending a steady stream of crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause a memory leak, which could result in a denial of service (DoS) condition when the device unexpectedly reloads. Note: This vulnerability cannot be exploited by transit traffic through the device. The crafted LLDP packet must be targeted to a directly connected interface, and the attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). In addition, the attack surface for this vulnerability can be reduced by disabling LLDP on interfaces where it is not required.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-lldp-dos-ySCNZOpX cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-10-25T16:03:47.738Z

Reserved: 2022-10-27T00:00:00

Link: CVE-2023-20089

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-02-23T20:15:13.557

Modified: 2024-11-21T07:40:31.967

Link: CVE-2023-20089

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses