Cisco Nexus 9000 ACI Mode (LLDP subsystem): A buffer overflow in the LLDP subsystem of Nexus 9000 switches in ACI mode

Impact

A buffer overflow in the LLDP subsystem of Nexus 9000 switches in ACI mode gives an adjacent unauthenticated attacker denial of service or arbitrary code execution with root privileges on the switch. In ACI, LLDP is not optional — it is how the fabric discovers and validates its own topology — so you cannot simply turn it off the way you can on a standalone NX-OS leaf.

Who can reach it

Unauthenticated, adjacent — a crafted LLDP frame from a device on a leaf port.

What to do

ACI software upgrade across the fabric (APIC plus switches), staged. There is no good config workaround because ACI depends on LLDP; the compensating control is strict physical and port-admission control on leaf front-panel ports. Related memory-leak issue in the same subsystem: CVE-2023-20089.

References