This vulnerability involves an uncontrolled resource consumption flaw in the connection-handling mechanism of Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO). Due to insufficient rate-limiting on incoming connections, an unauthenticated remote attacker can flood the system with connection requests, exhausting available connection resources. This leads to a denial of service condition where the affected systems become unresponsive and require manual reboot for recovery. The vulnerability affects a broad range of versions of Cisco Crosswork Network Change Automation products. The CVSS 3.1 base score is 7.5, indicating high severity, with no confidentiality or integrity impact but a significant impact on availability.

Successful exploitation results in denial of service by exhausting connection resources, causing Cisco CNC and NSO systems to become unresponsive. This disrupts legitimate user access and dependent services until the system is manually rebooted. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for unusual connection request patterns and consider implementing external rate-limiting or network-level protections to mitigate potential DoS attempts. No vendor advisory or official remediation has been provided yet.