Read the docs
TI-2025-14461 Aliases CVE-2025-20161GHSA-wc27-6x2h-q38w

Cisco NX-OS Software Command Injection Vulnerability

Priority LOW 26CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of specific elements within a software image. An attacker could exploit this vulnerability by installing a crafted image. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.  Note: Administrators should validate the hash of any software image before installation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco NX-OS Software9.2(3); 7.0(3)I5(2); 6.0(2)A8(7a); 7.0(3)I4(5); 7.0(3)I4(6); 7.0(3)I4(3); 9.2(2v); 7.0(3)I4(7); 7.0(3)I4(1); 7.0(3)I4(8); 7.0(3)I4(2); 6.0(2)A8(11); 9.2(1); 9.2(2t); 9.2(3y); 7.0(3)I4(1t); 7.0(3)I7(6z); 9.3(2); 7.0(3)F3(3); 7.0(3)I7(3z); 7.0(3)IM7(2); 6.0(2)A8(11b); 7.0(3)I7(5a); 7.0(3)I6(1); 7.0(3)I5(3b); 9.2(4); 6.0(2)A8(10); 6.0(2)A8(2); 7.0(3)IC4(4); 7.0(3)F3(3c); 7.0(3)F3(1); 7.0(3)F3(5); 7.0(3)I7(2); 7.0(3)I5(3); 7.0(3)I7(3); 6.0(2)A8(6); 7.0(3)I6(2); 6.0(2)A8(5); 9.3(1); 6.0(2)A8(7); 7.0(3)I7(6); 6.0(2)A8(11a); 7.0(3)I4(8z); 7.0(3)I4(9); 7.0(3)I7(4); 7.0(3)I7(7); 6.0(2)A8(9); 6.0(2)A8(1); 6.0(2)A8(10a); 7.0(3)I5(1); 9.3(1z); 9.2(2); 7.0(3)F3(4); 7.0(3)I4(8b); 6.0(2)A8(3); 7.0(3)I4(6t); 7.0(3)I5(3a); 6.0(2)A8(8); 7.0(3)I7(5); 7.0(3)F3(3a); 6.0(2)A8(4); 7.0(3)I4(8a); 7.0(3)F3(2); 7.0(3)I4(4); 7.0(3)I7(1); 7.0(3)IA7(2); 7.0(3)IA7(1); 6.0(2)A8(7b); 6.0(2)A8(4a); 9.3(3); 7.0(3)I7(8); 9.3(4); 9.3(5); 7.0(3)I7(9); 9.3(6); 10.1(2); 10.1(1); 9.3(5w); 9.3(7); 9.3(7k); 7.0(3)I7(9w); 10.2(1); 9.3(7a); 9.3(8); 7.0(3)I7(10); 10.2(1q); 10.2(2); 9.3(9); 10.1(2t); 10.2(3); 10.2(3t); 9.3(10); 10.2(2a); 10.3(1); 10.2(4); 10.3(2); 9.3(11); 10.3(3); 10.2(5); 9.3(12); 10.2(3v); 10.4(1); 10.3(99w); 10.2(6); 10.3(3w); 10.3(99x); 10.3(3o); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 10.3(5); 10.2(7); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.2(8); 10.3(3r); 10.3(6); 9.3(14); 10.3(4h)—No fix listedCNA
  • Cisco NX-OS Software VendorCisco Affected 9.2(3); 7.0(3)I5(2); 6.0(2)A8(7a); 7.0(3)I4(5); 7.0(3)I4(6); 7.0(3)I4(3); 9.2(2v); 7.0(3)I4(7); 7.0(3)I4(1); 7.0(3)I4(8); 7.0(3)I4(2); 6.0(2)A8(11); 9.2(1); 9.2(2t); 9.2(3y); 7.0(3)I4(1t); 7.0(3)I7(6z); 9.3(2); 7.0(3)F3(3); 7.0(3)I7(3z); 7.0(3)IM7(2); 6.0(2)A8(11b); 7.0(3)I7(5a); 7.0(3)I6(1); 7.0(3)I5(3b); 9.2(4); 6.0(2)A8(10); 6.0(2)A8(2); 7.0(3)IC4(4); 7.0(3)F3(3c); 7.0(3)F3(1); 7.0(3)F3(5); 7.0(3)I7(2); 7.0(3)I5(3); 7.0(3)I7(3); 6.0(2)A8(6); 7.0(3)I6(2); 6.0(2)A8(5); 9.3(1); 6.0(2)A8(7); 7.0(3)I7(6); 6.0(2)A8(11a); 7.0(3)I4(8z); 7.0(3)I4(9); 7.0(3)I7(4); 7.0(3)I7(7); 6.0(2)A8(9); 6.0(2)A8(1); 6.0(2)A8(10a); 7.0(3)I5(1); 9.3(1z); 9.2(2); 7.0(3)F3(4); 7.0(3)I4(8b); 6.0(2)A8(3); 7.0(3)I4(6t); 7.0(3)I5(3a); 6.0(2)A8(8); 7.0(3)I7(5); 7.0(3)F3(3a); 6.0(2)A8(4); 7.0(3)I4(8a); 7.0(3)F3(2); 7.0(3)I4(4); 7.0(3)I7(1); 7.0(3)IA7(2); 7.0(3)IA7(1); 6.0(2)A8(7b); 6.0(2)A8(4a); 9.3(3); 7.0(3)I7(8); 9.3(4); 9.3(5); 7.0(3)I7(9); 9.3(6); 10.1(2); 10.1(1); 9.3(5w); 9.3(7); 9.3(7k); 7.0(3)I7(9w); 10.2(1); 9.3(7a); 9.3(8); 7.0(3)I7(10); 10.2(1q); 10.2(2); 9.3(9); 10.1(2t); 10.2(3); 10.2(3t); 9.3(10); 10.2(2a); 10.3(1); 10.2(4); 10.3(2); 9.3(11); 10.3(3); 10.2(5); 9.3(12); 10.2(3v); 10.4(1); 10.3(99w); 10.2(6); 10.3(3w); 10.3(99x); 10.3(3o); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 10.3(5); 10.2(7); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.2(8); 10.3(3r); 10.3(6); 9.3(14); 10.3(4h) Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*——Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions — — ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-20161
  2. 2026-10-03 Alias added: GHSA-wc27-6x2h-q38w

References

Other 1

  • TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences