Cisco Nexus 3000/9000 (internal file management service): Unauthenticated remote file write, read and delete as root

Impact

Unauthenticated remote file write, read and delete as root on the switch, over a service that listens on the management interface by default. An attacker on the management network can drop a file, replace a config, or wipe the box without ever having a credential. This is the single worst pre-auth exposure in the Nexus line and it is a good argument for treating the switch management VLAN as production, not as 'internal'.

Who can reach it

Unauthenticated, remote — anything that can reach TCP/9075 on the switch's mgmt0 interface. No credentials required.

What to do

NX-OS image upgrade and switch reload. As a stopgap, an interface ACL on mgmt0 restricting the affected port materially reduces exposure and can be applied live with no reload. Rollout: one reload per switch, drain-and-patch per MLAG pair.

References