Cisco NX-OS Software Link Layer Discovery Protocol buffer access with incorrect length value

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco NX-OS Software, NX-OS System Software in ACI Mode and Unified Computing System. Affected by this issue is some unknown functionality of the component Link Layer Discovery Protocol. Such manipulation leads to buffer access with incorrect length value. This vulnerability is referenced as CVE-2026-20010. The attack needs to be initiated within the local network. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco NX-OS Software, NX-OS System Software in ACI Mode and Unified Computing System (affected version unknown) and classified as critical. Affected by this issue is an unknown functionality of the component Link Layer Discovery Protocol. The manipulation with an unknown input leads to a buffer access with incorrect length value vulnerability. Using CWE to declare the problem leads to CWE-805. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. Impacted is availability. CVE summarizes:

A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP process to restart, which could cause an affected device to reload unexpectedly. This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).

The advisory is available at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2026-20010 since 10/08/2025. The exploitation is known to be easy. The attack can only be done within the local network. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 02/28/2026).

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• NX-OS Software
• NX-OS System Software in ACI Mode
• Unified Computing System

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion