Description

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-02T17:17:31.547Z",
  "pubdate": "2026-09-02T17:17:31.547Z",
  "executiveSummary": "This vulnerability involves an unauthenticated remote code execution (RCE) flaw residing within the Silicon One integration component of Cisco Nexus 9000 Series Switches.\nThe vulnerability is characterized by the exposure of management ports 43210 and 43211 within the default Layer 3 (L3) virtual routing and forwarding (VRF) instance.\nSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary code with root-level privileges on the affected hardware.\nThe impact extends to full system compromise, including the potential for a denial-of-service (DoS) condition where the S1HAL process crashes, resulting in an unscheduled device reload.\nThe risk is critical due to the lack of required authentication and the attainment of root privileges, providing the attacker complete control over the switch's control plane.\nExploitation requires network-level reachability to the aforementioned TCP ports in the default VRF.",
  "technicalDetails": "The vulnerability originates from the improper exposure of internal service ports 43210 and 43211 on Cisco Nexus 9000 Series Switches that utilize Silicon One architecture.\nThese ports, which are intended for internal component communication, are erroneously accessible via the default Layer 3 (L3) virtual routing and forwarding (VRF) interface. This configuration failure expands the attack surface, allowing external entities to interact directly with internal subsystems.\nThe exploitation flow begins when an unauthenticated remote attacker initiates a TCP connection to port 43210 or 43211. Upon establishing the connection, the attacker transmits crafted, malicious input designed to interact with the Silicon One hardware abstraction layer (S1HAL) process.\nDue to a lack of proper input validation or sanitization mechanisms within the S1HAL interface, the supplied crafted data is processed in a manner that triggers a memory corruption or command injection vulnerability.\nAs the S1HAL process typically executes with elevated system permissions, the successful injection and execution of arbitrary code allow the attacker to inherit root privileges on the device's underlying operating system.\nBeyond arbitrary command execution, if the injected payload is malformed or improperly handled, it causes the S1HAL process to encounter a fatal exception. Because S1HAL is a critical component for hardware management, this exception triggers a process crash, which cascades into an automatic system reload as a fail-safe mechanism, effectively causing a denial-of-service condition.\nThe root cause is a failure in access control policies that bind internal-only services to globally or VRF-accessible interfaces, combined with insufficient validation of data received on these ports. The privilege escalation is a direct result of the high-integrity environment in which the vulnerable S1HAL component operates.\nThe attack is characterized as remote and unauthenticated, requiring no prior system access or credentials, making it highly dangerous for exposed infrastructure."
}