Memory corruption in Cisco NX-OS Software Fibre Channel over Ethernet
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when an FCoE-related process unexpectedly reloads. This vulnerability affects Cisco NX-OS Software on the following Cisco devices when they are configured for FCoE: Multilayer Director Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches. More Information: CSCvc91729. Known Affected Releases: 8.3(0)CV(0.833). Known Fixed Releases: 8.3(0)ISH(0.62) 8.3(0)CV(0.944) 8.1(1) 8.1(0.8)S0 7.3(2)D1(0.47).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco NX-OS Software Fibre Channel over Ethernet | Cisco NX-OS Software Fibre Channel over Ethernet | — | No fix listed | CNA |
- Cisco NX-OS Software Fibre Channel over Ethernet Vendor— Affected Cisco NX-OS Software Fibre Channel over Ethernet Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:mds_9000_nx-os:7.3\(1\)d1\(1\):*:*:*:*:*:*:* | 7.3(1)d1(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:nx-os_for_nexus_5500_platform_switches:7.3\(1\)n1\(1\):*:*:*:*:*:*:* | 7.3(1)n1(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:nx-os_for_nexus_5600_platform_switches:7.3\(1\)n1\(1\):*:*:*:*:*:*:* | 7.3(1)n1(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:nx-os_for_nexus_7700_series_switches:8.0\(1\)\(ed\):*:*:*:*:*:*:* | 8.0(1)(ed) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:nx-os:8.0\(1\)s2:*:*:*:*:*:*:* | 8.0(1)s2 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:nx-os:8.3\(0\)cv\(0.833\):*:*:*:*:*:*:* | 8.3(0)cv(0.833) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:mds_9000_nx-os:7.3\(1\)d1\(1\):*:*:*:*:*:*:* Versions 7.3(1)d1(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:nx-os_for_nexus_5500_platform_switches:7.3\(1\)n1\(1\):*:*:*:*:*:*:* Versions 7.3(1)n1(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:nx-os_for_nexus_5600_platform_switches:7.3\(1\)n1\(1\):*:*:*:*:*:*:* Versions 7.3(1)n1(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:nx-os_for_nexus_7700_series_switches:8.0\(1\)\(ed\):*:*:*:*:*:*:* Versions 8.0(1)(ed) Vulnerable ·Cisco
- cpe:2.3:o:cisco:nx-os:8.0\(1\)s2:*:*:*:*:*:*:* Versions 8.0(1)s2 Vulnerable ·Cisco
- cpe:2.3:o:cisco:nx-os:8.3\(0\)cv\(0.833\):*:*:*:*:*:*:* Versions 8.3(0)cv(0.833) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6655
- 2026-10-03 Alias added: GHSA-ffjq-497x-2qq5
References
More Cisco Mds 9000 Nx-os vulnerabilities
- TI-2015-03628 Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.9)… CVSS 2.0MEDIUM 6.1
- TI-2015-00723 The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices… CVSS 2.0MEDIUM 5.0
- TI-2012-01191 The Fibre Channel over IP (FCIP) implementation in Cisco MDS NX-OS 4.2 and 5.2 on MDS… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2017-6655 · CVE Program
- CVE-2017-6655 · NVD
- FIRST EPSS
- GHSA-ffjq-497x-2qq5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences