Cisco NX-OS (bootloader / image signature verification): Secure boot on the switch is defeatable: an attacker

Impact

Secure boot on the switch is defeatable: an attacker with physical access or admin credentials can make a Nexus load an unsigned NX-OS image. That is how a fabric compromise becomes permanent — a modified image keeps root across reloads and reflashes, and nothing in your config management will notice. Affects Nexus 3000/7000/9000, MDS 9000 and UCS 6400/6500 fabric interconnects, so it covers both the Ethernet and the storage fabric.

Who can reach it

Physical access to the switch (console/bootloader prompt) or an existing administrative account. Realistic threat model for colocation, shared cages, and any switch that has passed through a supply chain or an RMA.

What to do

BIOS update on both the primary and the alternate BIOS bank — either through install all with a fixed NX-OS release or Cisco's release-independent BIOS upgrade script. This is a firmware flash, needs a reload, and must be applied per-device; you cannot fix it with config. Pair it with physical access control on the console ports.

References