SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76471

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessCommandLine contains "nxapi" and RemotePort == 80 or RemotePort == 443
| where ActionType == "ConnectionAttempt" or ActionType == "ConnectionSuccess"
| summarize count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| where count_ > 5 // Adjust threshold as needed for unusual activity

Splunk SPL

index=* (sourcetype=cisco:nxos OR sourcetype=cisco:ucs) nxapi | stats count by host, src_ip, dest_port | where count > 5

Sigma

title: Cisco NX-OS NX-API RCE Attempt
logsource:
  product: cisco
  service: nxos
detection:
  selection:
    event_simpleName: "nxapi_access"
    http_method: ["POST", "PUT"]
    http_uri|contains: "/api/"
  condition: selection
  falsepositives:
    - Legitimate NX-API usage
  level: high

Elastic ES|QL

from logs-cisco.nxos-*
| where message : "nxapi" and (destination.port == 80 or destination.port == 443)
| summarize event_count = count() by host.name, source.ip, destination.port
| where event_count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen