Cisco Nexus 9000 Series Switches

CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211

Cisco published cisco-sa-n9k-s1-rce-EH8dEtr on 2026-09-02, disclosing CVE-2026-20212 (CVSS 9.8, CWE-1327 Binding to an Unrestricted IP Address) in the Silicon One ASIC integration on Nexus 9000 Series switches. TCP ports 43210 and 43211, used by the S1HAL (Silicon One Hardware Abstraction Layer) process, are reachable in the default Layer 3 VRF; an unauthenticated remote attacker who can reach either port sends crafted input that executes as root, or crashes the S1HAL process, which could cause the device to reload (Cisco PSIRT, 2026-09-02). Only switches carrying a Silicon One ASIC are affected. Cisco names ten specific product IDs, determinable via show module, and the advisory's own "Products Confirmed Not Vulnerable" section explicitly excludes the Nexus 3000 Series and every other Nexus 9000 model, so inventory should key on the ten Silicon One product IDs rather than on the Nexus 9000 family name, as Cisco's own advisory title "Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability" might suggest (Cisco PSIRT, 2026-09-02). Cisco also lists Nexus 9000 Series Fabric Switches in ACI mode as not vulnerable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a Technical Assistance Center (TAC) support case and states it is not aware of any public announcement or malicious use (Cisco PSIRT, 2026-09-02).

Fixed NX-OS software is available via Cisco's Software Checker. Until upgraded, Cisco's workaround is infrastructure ACLs (iACLs) that allow only required management and control-plane traffic to the device, or that deny all TCP packets to a locally configured address on ports 43210 or 43211. Cisco also offers a temporary NX-OS Live Protect shield for this CVE and treats every workaround as a bridge to the fixed release, not a substitute (Cisco PSIRT, 2026-09-02).