CVE-2023-20169 is a denial-of-service vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software, affecting Cisco Nexus 3000 and 9000 Series Switches in standalone mode. An unauthenticated, adjacent attacker can exploit insufficient input validation by sending a crafted IS-IS packet, causing the IS-IS process to restart and potentially reloading the device. Rated 7.4 HIGH (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), this vulnerability requires Layer 2 adjacency for exploitation. There is no public exploit code (Metasploit, Nuclei, ExploitDB), it is not in the KEV catalog, and while it has seen some community discussion and media coverage, it is not currently considered actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
10.3\(2\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:10.3\(2\):*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.