Cisco NX-OS (MPLS traffic handling / netstack): Crafted MPLS traffic restarts netstack, which stops the switch

Impact

Crafted MPLS traffic restarts netstack, which stops the switch forwarding or reloads it. Applies even where you are not consciously running MPLS, because the parse path is reachable regardless. One packet stream, one leaf down.

Who can reach it

Unauthenticated, remote — an attacker able to send MPLS-labelled frames toward the device.

What to do

NX-OS upgrade plus reload. Filter MPLS ethertype at the fabric edge as a live mitigation if you do not use MPLS, which most GPU-cluster fabrics do not.

References

Related entries

• Cisco NX-OS (eBGP implementation): An unauthenticated remote attacker can wedge the switch through the eBGPCVE-2024-20321 · Cisco NX-OS (eBGP implementation)High
• Cisco NX-OS (DHCPv6 relay agent): A crafted DHCPv6 packet takes the switch out. Relevant because DHCP relay is normallyCVE-2024-20446 · Cisco NX-OS (DHCPv6 relay agent)High
• Linux bnxt_en driver (TX BD bd_cnt field masking): The 5-bit bd_cnt field in the transmit buffer descriptorCVE-2025-22108 · Linux bnxt_en driver (TX BD bd_cnt field masking)High
• Intel AMT and Intel Standard Manageability firmware (current CSME generations): Out-of-bounds write in AMT/ISM firmwareCVE-2025-32008 · Intel AMT and Intel Standard Manageability firmware (current CSME generations)High
• Eaton UPS Companion (EUC) software installer: The installer does not properly authenticate the library files it loadsCVE-2025-59887 · Eaton UPS Companion (EUC) software installerHigh
• Eaton Tripp Lite series PADM firmware (rack PDU / ATS management): Unauthenticated authentication bypass givesCVE-2026-22620 · Eaton Tripp Lite series PADM firmware (rack PDU / ATS management)High