Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability
Priority MEDIUM 55CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The vulnerability is due to the presence of a default SSH key pair that is present in all devices. An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user. This vulnerability is only exploitable over IPv6; IPv4 is not vulnerable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03451 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode 11.0.1b | all versions | — | No fix listed | CNA |
- Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode 11.0.1b VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:nexus_9332pq_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_93180yc-ex_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_93128tx_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_93120tx_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_93108tc-ex_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:nexus_9332pq_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_93180yc-ex_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_93128tx_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_93120tx_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_93108tc-ex_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:nexus_9516_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9508_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9504_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9500_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9396tx_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9396px_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9372tx_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:nexus_9372px_firmware:14.0\(3d\):*:*:*:*:*:*:* | 14.0(3d) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:nexus_9516_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9508_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9504_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9500_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9396tx_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9396px_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9372tx_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:nexus_9372px_firmware:14.0\(3d\):*:*:*:*:*:*:* Versions 14.0(3d) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1804
- 2026-10-03 Alias added: GHSA-9hxx-97w4-fh95
References
More Cisco Nexus 93108tc-ex Firmware vulnerabilities
- TI-2022-05382 Cisco NX-OS Software OSPFv3 Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2022-05383 Cisco FXOS and NX-OS Software Cisco Discovery Protocol Denial of Service and Arbitrary Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2021-09211 L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers CVSS 3.1MEDIUM 4.7
Sources
- CVE-2019-1804 · CVE Program
- CVE-2019-1804 · NVD
- FIRST EPSS
- GHSA-9hxx-97w4-fh95 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences