Description

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T21:18:41.973Z",
  "pubdate": "2026-09-01T21:18:41.973Z",
  "executiveSummary": "A denial-of-service (DoS) vulnerability exists within the command line interface (CLI) of the AOS-CX network operating system.\nThis flaw allows an authenticated user to induce a disruption of normal system operations, potentially resulting in service instability or loss of administrative control.\nThe vulnerability is characterized by a failure in the CLI command parsing or execution logic, which can be triggered by specifically crafted input sequences.\nThe impact is primarily localized to the availability of the device management plane. While the underlying switching fabric may continue to process traffic, the administrative interface becomes unresponsive, preventing network operators from performing configuration changes or monitoring tasks.\nExploitation requires that the attacker has authenticated access to the device's CLI environment. The vulnerability represents a security risk to network availability in environments where multi-tenant or delegated administrative access is provided to potentially untrusted users.\nRisk mitigation is highly dependent on controlling access to the management plane and maintaining updated firmware versions as provided by the vendor.",
  "technicalDetails": "The vulnerability resides in the command line interface (CLI) subsystem of the AOS-CX platform, which is responsible for parsing, validating, and executing administrative commands.\nThe root cause involves improper handling of specific command strings or parameters that lead to a resource exhaustion state or a crash of the CLI process (e.g., the daemon responsible for terminal sessions).\nExploitation requires an authenticated session. The attacker leverages the command entry interface to submit malformed or intentionally complex commands designed to trigger an unhandled exception within the CLI process memory space.\nThe attack flow begins with the establishment of an authenticated session via SSH, console, or other CLI-accessible channels. Once authorized, the attacker injects the trigger payload—a specific sequence of characters or commands—into the CLI input stream.\nUpon processing the malicious payload, the affected component fails to safely handle the input, leading to an abnormal termination or hang of the management process. Because the CLI daemon is critical for session management, its failure effectively locks out all users, preventing further configuration, telemetry collection, or maintenance.\nIf the CLI process does not automatically restart or fails to recover state, the device management plane remains unavailable until a system-level intervention, such as a process restart or hardware reboot, is performed.\nThe exposure is limited to the management plane and does not necessarily imply compromise of the control plane (routing protocols) or the data plane (packet forwarding). However, the resulting inability to manage the device constitutes a total loss of availability from an administrative perspective.\nThe vulnerability relies on the authenticated user having enough privilege to access the specific CLI context where the flaw exists. The lack of robust input validation against malformed commands is the primary technical failure."
}