CVE-2025-20262 Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability
An authenticated low-privileged remote attacker can crash the PIM6 process on Cisco Nexus switches via crafted queries, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20262?
CVE-2025-20262 is a medium-severity vulnerability in Cisco NX-OS Software, published on 27 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.
Weakness: CWE-476
Which versions are affected by CVE-2025-20262?
How do I fix CVE-2025-20262?
No fix has been published for CVE-2025-20262 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20262 being exploited?
There is no known exploitation of CVE-2025-20262 in the wild and no public exploit code.
Sources
Also known as GHSA-3q92-5vpf-96pw.