Cisco NX-OS (DHCPv6 relay agent): A crafted DHCPv6 packet takes the switch out. Relevant because DHCP relay is normally

Impact

A crafted DHCPv6 packet takes the switch out. Relevant because DHCP relay is normally configured on exactly the SVIs that face tenant workloads, so this is reachable from inside a tenant network with no credentials at all.

Who can reach it

Unauthenticated, remote — a host on a VLAN where DHCPv6 relay is configured.

What to do

NX-OS upgrade plus reload. If IPv6 is unused in your cluster (still common), disabling the DHCPv6 relay is a live config change that removes the exposure with no downtime.

References

Related entries

• Linux bnxt_en driver (TX BD bd_cnt field masking): The 5-bit bd_cnt field in the transmit buffer descriptorCVE-2025-22108 · Linux bnxt_en driver (TX BD bd_cnt field masking)High
• Intel AMT and Intel Standard Manageability firmware (current CSME generations): Out-of-bounds write in AMT/ISM firmwareCVE-2025-32008 · Intel AMT and Intel Standard Manageability firmware (current CSME generations)High
• Eaton UPS Companion (EUC) software installer: The installer does not properly authenticate the library files it loadsCVE-2025-59887 · Eaton UPS Companion (EUC) software installerHigh
• Eaton Tripp Lite series PADM firmware (rack PDU / ATS management): Unauthenticated authentication bypass givesCVE-2026-22620 · Eaton Tripp Lite series PADM firmware (rack PDU / ATS management)High
• Arista EOS: crafted gNSI Credentialz request can grant an account privileges beyond what was configuredCVE-2026-73454 · Arista EOS gNSI Credentialz serviceHigh
• InfiniBand / RoCEv2 transport - RNIC connection state (QP number, PSN) on Mellanox ConnectX-class and compatible RNICsNCVD-2021-003-infiniband-rocev2-transport-rnic · InfiniBand / RoCEv2 transport - RNIC connection state (QP number, PSN) on Mellanox ConnectX-class and compatible RNICsHigh