August 28, 2025
Cisco Systems has published a security advisory detailing a high-severity denial-of-service (DoS) vulnerability affecting Cisco Nexus 3000 and 9000 Series Switches running NX-OS software. The flaw, tracked as CVE-2025-20241 with a CVSS score of 7.4, could allow an unauthenticated, adjacent attacker to disrupt core network operations.
Cisco explains that “a vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software… could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload.”
The issue arises from insufficient input validation when parsing incoming IS-IS packets. By sending a crafted IS-IS packet to a vulnerable device, attackers could force the IS-IS process to crash and reload, resulting in a denial of service condition.
Exploitation is limited to attackers with Layer 2 adjacency to the targeted device. The advisory clarifies: “This vulnerability can only be exploited by an adjacent IS-IS peer in the UP state. If IS-IS authentication is enabled, the IS-IS peer would need to use a valid key to exploit this vulnerability.”
Administrators can check whether IS-IS is enabled by running:
show running-config | include isisIf configuration commands such as feature isis, router isis <name>, and ip router isis <name> appear, IS-IS is active. Similarly, the show isis adjacency command reveals active IS-IS peers.
The vulnerability affects:
- Cisco Nexus 3000 Series Switches
- Cisco Nexus 9000 Series Switches in standalone NX-OS mode
Only devices with the IS-IS routing protocol enabled are vulnerable.
Cisco has released free software updates to patch the flaw. Customers with service contracts can obtain fixes through their standard update channels.
For organizations unable to upgrade immediately, enabling IS-IS authentication with strong keys significantly reduces the risk of exploitation.
Organizations running Nexus 3000 and 9000 switches should apply Cisco’s patches without delay and review their IS-IS configurations to harden defenses.
