Cisco NX-OS (DHCPv6 relay agent): FABRIC DOS: a crafted DHCPv6 packet takes the switch out

CVE-2024-20446Firmware, BMC & network fabriccurated

Impact

FABRIC DOS: a crafted DHCPv6 packet takes the switch out. Relevant because DHCP relay is normally configured on exactly the SVIs that face tenant workloads, so this is reachable from inside a tenant network with no credentials at all.

Who can reach it

Unauthenticated, remote — a host on a VLAN where DHCPv6 relay is configured.

What to do

NX-OS upgrade plus reload. If IPv6 is unused in your cluster (still common), disabling the DHCPv6 relay is a live config change that removes the exposure with no downtime.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-20446

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.