QID 316953

Date Published: 2021-05-06

QID 316953: Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability(cisco-sa-20181017-fxnx-os-dos)

A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads.

Affected Products
Firepower 4100 Series Next-Generation Firewall
Firepower 9300 Security Appliance
MDS 9000 Series Multilayer Switches
Nexus 2000 Series Switches
Nexus 3000 Series Switches
Nexus 3500 Platform Switches
Nexus 5500 Platform Switches
Nexus 5600 Platform Switches
Nexus 6000 Platform Switches
Nexus 7000 Series Switches
Nexus 7700 Series Switches
Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode
Unified Computing System (UCS) 6100 Series Fabric Interconnects
UCS 6200 Series Fabric Interconnects
UCS 6300 Series Fabric Interconnects
Note: This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco FXOS or NX-OS Software and LLDP is enabled on an interface

QID Detection Logic(Authenticated):
It checks for vulnerable version of Cisco NX-OS using show version Command.

Note: QID made practice as LLDP configuration cannot be checked

A successful exploit could allow the attacker to cause the switch to reload unexpectedly.

  • CVSS V3 rated as Medium - 5.3 severity.
  • CVSS V2 rated as Low - 2.9 severity.
    • Solution

    Customers are advised to refer to cisco-sa-20181017-fxnx-os-dos for more information.

    Vendor References

    CVEs related to QID 316953

    CVE-2018-0395 |
    Software Advisories
    Advisory ID Software Component Link
    cisco-sa-20181017-fxnx-os-dos URL Logo tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-fxnx-os-dos
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].