CVE-2025-20262: Cisco NX-OS Software · NULL Pointer Dereference
Affects Cisco NX-OS SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.0 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 27 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco NX-OS Software | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should implement the following specific measures: 1) Immediately identify and inventory all Cisco Nexus 3000 and 9000 Series switches running affected NX-OS versions. 2) Apply Cisco-provided patches or software updates as soon as they become available, prioritizing devices in critical network segments. 3) Restrict access to management interfaces (NX-API REST, NETCONF, RESTConf, gRPC, Model Driven Telemetry) by implementing strict access control lists (ACLs), network segmentation, and multi-factor authentication to limit exposure to authorized personnel only. 4) Monitor network device logs and telemetry for unusual ephemeral query traffic patterns or repeated PIM6 process crashes that could indicate attempted exploitation. 5) Employ network anomaly detection systems focused on multicast routing behavior to detect adjacency flaps or process restarts promptly. 6) Harden internal security policies to prevent credential compromise, including regular password rotation and least privilege principles for network management accounts. 7) Consider temporarily disabling PIM6 or limiting its use if multicast IPv6 is not critical to operations until patches are applied. These targeted actions go beyond generic advice by focusing on controlling attack vectors, monitoring for exploitation signs, and prioritizing patch management in critical network infrastructure.
Description
A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.