Cisco NX-OS / FXOS (Cisco Discovery Protocol): Root code execution on the switch from a crafted CDP frame sent

CVE-2022-20824Firmware, BMC & network fabriccurated

Impact

Root code execution on the switch from a crafted CDP frame sent by anything on an adjacent link. CDP is a layer-2 protocol that is on by default and is not authenticated, so a compromised server NIC — or a tenant's bare-metal node — can attack the leaf it is cabled to directly. This is the classic 'the switch trusts the host' failure and it is why CDP/LLDP should be off on tenant-facing ports.

Who can reach it

Unauthenticated, adjacent — layer-2 reachability to the switch port. Any host on the link, including a tenant's own machine.

What to do

NX-OS upgrade plus reload. Immediate config mitigation: disable CDP globally or per-interface on all host-facing ports (no cdp enable), which is a live change with no reload and is good hygiene independent of the CVE. Same treatment applies to the older CDP RCEs (CVE-2020-3119, CVE-2020-3172, CVE-2018-0303).

References

https://nvd.nist.gov/vuln/detail/CVE-2022-20824 https://nvd.nist.gov/vuln/detail/CVE-2020-3119

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.