Cisco Nexus 3000 Nexus Data Broker Denial of Service Vulnerability

A vulnerability in the Nexus Data Broker (NDB) in Cisco Nexus 3000 Series Switches could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition.

The vulnerability is in handling incoming connections to the Java application. An attacker could exploit this vulnerability by sending crafted Java connections to the NDB. An exploit could allow the attacker to cause the Java process to restart, causing a partial DoS condition on the device.

Cisco has confirmed the vulnerability and released software updates.

To exploit this vulnerability, the attacker would need to send crafted Java connections to a targeted device, making exploitation more difficult in environments that restrict network access from untrusted sources.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.