CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
← Back to Daily brief 2026-09-04
HIGHCVE-2026-20212updatedNATOA2vulnerability

CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211

Cisco patches an unauthenticated path to root code execution on Nexus 9000 switches carrying a Silicon One ASIC

Defender actions

  • Run show module on every Nexus 9000 switch to identify units carrying a Silicon One ASIC (PIDs N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804/9808); upgrade those to a fixed NX-OS release via Cisco's Software Checker, and until upgraded, deploy an infrastructure ACL denying TCP destined to ports 43210/43211 or Cisco's Live Protect shield for CVE-2026-20212.

Analysis

Cisco published cisco-sa-n9k-s1-rce-EH8dEtr on 2026-09-02, disclosing CVE-2026-20212 (CVSS 9.8, CWE-1327 Binding to an Unrestricted IP Address) in the Silicon One ASIC integration on Nexus 9000 Series switches. TCP ports 43210 and 43211, used by the S1HAL (Silicon One Hardware Abstraction Layer) process, are reachable in the default Layer 3 VRF; an unauthenticated remote attacker who can reach either port sends crafted input that executes as root, or crashes the S1HAL process, which could cause the device to reload (Cisco PSIRT, 2026-09-02). Only switches carrying a Silicon One ASIC are affected. Cisco names ten specific product IDs, determinable via show module, and the advisory's own "Products Confirmed Not Vulnerable" section explicitly excludes the Nexus 3000 Series and every other Nexus 9000 model, so inventory should key on the ten Silicon One product IDs rather than on the Nexus 9000 family name, as Cisco's own advisory title "Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability" might suggest (Cisco PSIRT, 2026-09-02). Cisco also lists Nexus 9000 Series Fabric Switches in ACI mode as not vulnerable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a Technical Assistance Center (TAC) support case and states it is not aware of any public announcement or malicious use (Cisco PSIRT, 2026-09-02).

Fixed NX-OS software is available via Cisco's Software Checker. Until upgraded, Cisco's workaround is infrastructure ACLs (iACLs) that allow only required management and control-plane traffic to the device, or that deny all TCP packets to a locally configured address on ports 43210 or 43211. Cisco also offers a temporary NX-OS Live Protect shield for this CVE and treats every workaround as a bridge to the fixed release, not a substitute (Cisco PSIRT, 2026-09-02).

Cited evidence

This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges.

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Cisco PSIRT 2026-09-02

Updates2

Correction

Hunt for connections to TCP ports 43210 and 43211 on the switches' addresses in the default Layer 3 VRF, where Cisco says the ports are reachable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a TAC support case, and the advisory does not describe the case as internal (Cisco PSIRT, 2026-09-02).

Correction

Cisco says a crash of the S1HAL process could cause the device to reload; the analysis had said the flaw forces a reload or crashes the device. Cisco also lists Nexus 9000 Series Fabric Switches in ACI mode as not vulnerable (Cisco PSIRT, 2026-09-02).

Sources3

Cisco PSIRTprimary · 2026-09-02NCSC-NLcorroborating · 2026-09-03CERT-FR / ANSSIcorroborating · 2026-09-03

Revision history

  1. Published 2026-09-04T0410Z-intel
  2. Correction 2026-09-30T0639Z-audit

    A sentence contrasted Cisco's product scope with the title of the MITRE CVE record rather than a cited advisory. It now makes the scoping point from Cisco's own advisory, and the sourcing note drops the rating narration. The detection guidance now points at the default Layer 3 VRF that Cisco names, the discovery is described as a TAC support case without calling it internal, and an uncited paragraph on two unrelated Cisco advisories is removed. The takeaway now asks for the patch or the iACL workaround ahead of the maintenance window and drops two claims no source makes, that exploitation compromises the fabric itself and that the ports have no legitimate use.

    Changed: sources sourcing_note body summary

  3. Correction 2026-10-11T1307Z-audit

    Cisco says a crash of the S1HAL process could cause the device to reload; the text and the summary had said it forces a reload or crashes the device. The analysis now also notes that Cisco lists Nexus 9000 fabric switches in ACI mode as not vulnerable.

    Changed: body summary

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.