Cisco Nexus 9000 ACI Mode Switch Software (fabric infrastructure VLAN): The earlier instance of the same ACI class of

Impact

The earlier instance of the same ACI class of bug — security validation on infrastructure-VLAN connection setup can be bypassed, letting an adjacent device join the fabric's internal VLAN. Worth tracking separately because the fixed releases differ and clusters running older ACI trains are exposed to this one and not the 2021 variant.

Who can reach it

Unauthenticated, adjacent — a device connected to a leaf port.

What to do

ACI fabric software upgrade (APIC + switches). Staged, multi-hour. No config-only workaround beyond locking down unused ports.

References

Related entries

• Intel E810 Ethernet Controller firmware: Buffer overflow in early E810 firmware, triggerable by an unauthenticatedCVE-2020-24501 · Intel E810 Ethernet Controller firmwareMedium
• Intel processors (shared resource isolation): Improper isolation of shared processor resources allowing informationCVE-2020-24511 · Intel processors (shared resource isolation)Medium
• Intel Atom processors (domain-bypass transient execution): A domain-bypass transient execution flaw on Atom partsCVE-2020-24513 · Intel Atom processors (domain-bypass transient execution)Medium
• Intel SGX DCAP (datacenter attestation primitives): An improper conditions check in DCAP lets an unauthenticatedCVE-2020-8766 · Intel SGX DCAP (datacenter attestation primitives)Medium
• Intel Ethernet 800 Series Controller firmware: Out-of-bounds read in 800-series (E810 family) adapter firmwareCVE-2021-0009 · Intel Ethernet 800 Series Controller firmwareMedium
• AMD processors - transient execution beyond unconditional direct branches: Some AMD CPUs transiently executeCVE-2021-26341 · AMD processors - transient execution beyond unconditional direct branchesMedium