Critical Command Injection Vulnerability Discovered in Cisco Nexus 3000 & 9000 Series Switches

Critical Vulnerability in Cisco Nexus 3000 & 9000 Series Switches Poses Major Security Risk

Cisco has issued a warning regarding a critical vulnerability (CVE-2025-20161) affecting the Nexus 3000 and Nexus 9000 Series Switches running in standalone NX-OS mode. The flaw, identified in Cisco's NX-OS Software, enables attackers with valid administrator credentials to exploit a command injection vulnerability during the software upgrade process. The issue arises from insufficient validation of specific elements within the software image, which could allow attackers to execute arbitrary commands with root-level privileges on the affected device.

This vulnerability, assigned a CVSS score of 5.1 (medium severity), is caused by flaws in the image verification process. By installing a specially crafted firmware image, an attacker can bypass the signature validation, triggering the execution of malicious commands on the operating system, potentially compromising network security.

Cisco has confirmed that this vulnerability impacts the following devices:

• Nexus 3000 Series Switches
• Nexus 9000 Series Switches (Standalone NX-OS deployments only)

However, products such as the Nexus 9000 in ACI mode, MDS 9000 Series, and Firepower appliances are not affected. Cisco has released patches to address the issue and has emphasized that there are no viable workarounds for affected users. To mitigate the risk, it’s critical to update to NX-OS 15.2(9)E1 for Nexus 3000 and NX-OS 10.4(3a)F or newer for Nexus 9000 series switches.

The vulnerability poses serious risks, including:

• Unauthorized execution of commands
• Potential interception of network traffic
• Manipulation of routing tables
• Backdoor access to affected systems

Security experts recommend that administrators ensure proper validation of software image hashes before installation to avoid potential exploitation. Role-based access control (RBAC) should also be enforced to limit administrative access and restrict the impact of any attacks.

Though no active exploitation has been reported, Cisco urges enterprises to accelerate their patching process to mitigate this risk. Additionally, organizations unable to update immediately should implement compensatory controls, such as network segmentation and continuous monitoring for unusual activity.

This advisory is part of a broader set of security updates included in the February 2025 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.