CVE-2026-20212: Binding to an Unrestricted IP Address in Cisco Cisco NX-OS Software

This vulnerability arises because TCP ports 43210 and 43211 are exposed in the default Layer 3 VRF on affected Cisco Nexus 9000 Series Switches running NX-OS Software. An unauthenticated remote attacker can connect to these ports and send crafted input that executes arbitrary code with root privileges. Additionally, exploitation may crash the S1HAL process, causing the device to reload. The vulnerability is identified as CVE-2026-20212 with a CVSS 3.1 base score of 9.8, indicating critical severity. It affects multiple versions of Cisco NX-OS Software, specifically numerous 10.3.x, 10.4.x, 10.5.x, and 10.6.x releases as enumerated in the affectedVersions field. No known exploits in the wild have been reported. The vulnerability is linked to CWEs 1327 and 354, related to binding to unrestricted IP addresses and improper access control.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with root privileges on affected devices, leading to full system compromise. It can also cause the S1HAL process to crash, potentially triggering device reloads and resulting in denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a patch is available, restricting access to TCP ports 43210 and 43211 in the Layer 3 VRF through network controls may reduce exposure.