SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20212

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score30/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection focuses on network traffic to TCP ports 43210 or 43211 on Cisco Nexus 9000 Series Switches. This indicates potential exploitation attempts or reconnaissance.

Sentinel/Defender KQL

NetworkConnectionEvents
| where DestinationPort == 43210 or DestinationPort == 43211
| where DeviceName contains "N9K" or DeviceName contains "Nexus 9000"
| summarize count() by DeviceName, DestinationIP, DestinationPort, InitiatingProcessFileName

Splunk SPL

index=* (dest_port=43210 OR dest_port=43211) (host=*N9K* OR host="*Nexus 9000*") | stats count by host, dest_ip, dest_port

Sigma

title: Cisco Nexus 9000 Silicon One RCE Attempt
logsource:
  category: network_connection
  product: cisco_nexus
detection:
  selection:
    dest_port:
      - 43210
      - 43211
    host_name|contains:
      - 'N9K'
      - 'Nexus 9000'
  condition: selection
level: high

Elastic ES|QL

from network_traffic
| where destination.port == 43210 or destination.port == 43211
| where host.name : ("*N9K*", "*Nexus 9000*")
| summarize count() by host.name, destination.ip, destination.port

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen