Strix
74.1K

CVE-2026-20173

MEDIUMCVSS 5.8/10EPSS 0.37%

Last modified

CVE-2026-20173 is a medium-severity vulnerability rated 5.8/10 on the CVSS scale. A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. EPSS estimates a 0.37% chance of exploitation in the next 30 days.

Description

A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.

Metrics

CVSS 3.1
5.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

EPSS Probability
0.37%

29.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
CiscoCisco NX-OS Software8.2(5); 7.3(5)D1(1); 8.4(2); 8.4(3); 9.2(3); 9.2(2v); 7.3(4)D1(1); 8.2(1); 9.2(1); 9.2(2t); 9.2(3y); 9.3(2); 8.1(1); 8.2(2); 8.3(2); 7.3(2)D1(3a); 9.2(4); 8.1(2); 7.3(3)D1(1); 8.2(3); 8.4(1); 7.3(0)DX(1); 7.3(2)D1(1); 9.3(1); 7.3(2)D1(2); 8.2(4); 9.3(1z); 9.2(2); 8.1(2a); 7.3(2)D1(3); 8.3(1); 7.3(1)D1(1); 7.3(0)D1(1); 9.3(3); 7.3(2)D1(1d); 9.3(4); 7.3(6)D1(1); 8.2(6); 9.3(5); 9.3(6); 8.4(4); 7.3(7)D1(1); 9.3(5w); 8.2(7); 9.3(7); 9.3(7k); 7.3(8)D1(1); 9.3(7a); 8.2(7a); 9.3(8); 8.4(4a); 8.4(5); 8.2(8); 9.3(9); 7.3(9)D1(1); 8.4(6); 9.3(10); 8.2(9); 10.3(1); 8.4(7); 10.3(2); 8.4(6a); 9.3(11); 10.3(3); 8.2(10); 9.3(12); 10.4(1); 8.4(8); 10.3(99w); 10.3(3w); 10.3(99x); 10.3(3o); 8.4(9); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 8.2(11); 10.3(5); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 8.4(10); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.5(2); 8.4(11); 10.3(7); 10.4(5); 10.5(3); 9.3(15); 10.4(4g); 10.5(4); 8.4(12); 10.5(3t); 10.3(8); 10.4(6); 10.5(3s); 10.5(3e); 10.5(3o); 9.3(16); 10.5(3p); 10.4(7); 10.5(5); 9.3(17)

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-20173?
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.
How severe is CVE-2026-20173?
CVE-2026-20173 has a CVSS score of 5.8/10 (MEDIUM severity). The EPSS model estimates a 0.37% probability of exploitation in the next 30 days.
How do I fix CVE-2026-20173?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-20173?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST