Cisco Nexus 3000 9000 Series Switches MPLS OAM RCE (cisco-sa-moam-rce-uBTzYV7)

#TRUSTED 4c3415259c57a2a99a4b1723015397e11d596531c9e80ec282fe6e661a7dfd1aabccb31417bf68b6cc21d3296061aa41041b65ebb3f7caa8a5d394d121dda6229d0594eae8b03b6e216cdf2402a29b01f55900a5d504cdbda8b8a5a8f7b48e493f946364d2a65ba248608a2a5f0e5a7ca425abb10831852e19f8bed8060f377a3cf3739f803d8a46f04d96e19d65c94c8f5dff8a5ea4b1f2e2a45d2f673a596be4fe6bc98dc9a357fb9e0c1d9237c41724e478fb157c04d2c3a1de06dd2e0aebf7715ac0a730981343e94e760405a2b2f495bcb825ca839af2c7ad1549c8ea1b6797df435b1bcd9dd8b16725e2b1e226c6f25a440e0e6581471a8f9d521208893d32279b916e5a1d6a70458388f1c8b25e8b196b20f74e9cafce2a6a3f43b15c024a6f089300067362ab0dc4cff5738c8a8b6eadef769e3026f36b691537a227564f95721d9501cf06829de2c8c8066309b8b371b5ad03f9d15a8d6f3663457db94d7de48a49124267b120c0972fb36a0c60c54d96dc1490bf1d2f269e1142cb648a994314c96fdb53952c12231db3b81a97a50462f5f5d6409f65de0ec9b6672a7965518f76de08433e93e2ddd0edaa48aa2eaf0d16d654fc0469e67b94adef6f8dcbf74c854398c3e1a6d9f444c55efda663b1110645705a3f7781c9c8fc31208561fff94537341aff1f4dc7290628bc2d60426f236e0ab43b715096459be2
#TRUST-RSA-SHA256 11b8a7ce5a9078326bdf47a358db2768fa1dc7ded98af04b6968d0a3709f964bb58b037935dfd8dcb93c621db23edf834e43d90b4b753ced329eb825c6da588bfd6f959073b30fdc784f0ac713bc22e8d3f8894d344b42210b5bc0c8d9f476d510f501564e02296813856d354f0226a0dc33f4f2a01a59242afab2d1aaf194466c866629fbb41cecf032169f9153ff5f885b27c3aa0c5374cc239847082e1bcdbcbad2812243e712bf2245a54bbff04939056ad687ef08011df32cdd1ae4bc5ea73ee3eabf401fa5895422d74647b3ede2da50be0a8e900a1313175f74973b7a3fa0ae058eb80761bda5cf804cf7b9827667e1a1fe3eead0ba4249a563b7ebad06d2db5b753661f222fe2a8772e96e7126f076f30e8519b60b77e0221fcf39767cbed59b3c85c2bcb1ac78c2d4df908dc54db960a917aaa61a07d59253d55c3f3a4590afd31f968197b2711debfff47ffef4b2c544361bd83bb8d169f172a4b26dafb9c1a9bea49f54dfdd4fd78c4c011f890d56f3aee5ce3914e794af1e26f5e6dd9e7c652cb0cb0fea3014cb14391c2dea7f534e96fa3b5ccb8dadb018b4a2e36dbf51ff86980401e1304bdc23cff18f973948165be522adbe4370ce37cc41b0343a415cd9109d2bcac221469aa8ae05556624d290ec2485366cdc5d4ea5676cd51b1b4e6d3d1f6f77eaa683685411747ba161750db08cd43ff0290f26c83d
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373713);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/02");

  script_cve_id("CVE-2026-76465");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu19799");
  script_xref(name:"CISCO-SA", value:"cisco-sa-moam-rce-uBTzYV7");
  script_xref(name:"IAVA", value:"2026-A-1091");

  script_name(english:"Cisco Nexus 3000 9000 Series Switches MPLS OAM RCE (cisco-sa-moam-rce-uBTzYV7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability.

  - A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS
    Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an
    unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of
    service (DoS) condition on an affected device. This vulnerability is due to improper validation when an
    affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by
    sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could
    allow the attacker to execute arbitrary code with root privileges and could cause process crashes,
    which could result in a device reload and a DoS condition. (CVE-2026-76465)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3e0ac365");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu19799");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu19799");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76465");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(590);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Host/Cisco/NX-OS/Device");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco NX-OS Software');


if (('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])3[0-9]{2,3}") &&
    ('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])9[0-9]{2,3}"))
audit(AUDIT_HOST_NOT, 'affected');

var version_list = [];

if ('Nexus' >< product_info.device && product_info.model =~ "^3[0-9]{2,3}")
{
  version_list = make_list(
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(4a)',
    '10.3(4)',
    '10.3(5)',
    '10.3(6)',
    '10.3(7)',
    '10.3(8)',
    '10.3(9)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(4)',
    '10.5(5)',
    '10.6(1)',
    '10.6(2)',
    '10.6(3)'
  );
}

if ('Nexus' >< product_info.device && product_info.model =~ "^9[0-9]{2,3}")
{
  version_list = make_list(
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(1z)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(5w)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(99w)',
    '10.3(3w)',
    '10.3(99x)',
    '10.3(3o)',
    '10.3(4a)',
    '10.3(3p)',
    '10.3(4)',
    '10.3(3q)',
    '10.3(3x)',
    '10.3(5)',
    '10.3(4g)',
    '10.3(3r)',
    '10.3(6)',
    '10.3(4h)',
    '10.3(7)',
    '10.3(8)',
    '10.3(9)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(4g)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(3t)',
    '10.5(3e)',
    '10.5(3o)',
    '10.5(3s)',
    '10.5(4)',
    '10.5(3p)',
    '10.5(5)',
    '10.6(1)',
    '10.6(1s)',
    '10.6(2)',
    '10.6(2s)',
    '10.6(2n)',
    '10.6(3)',
    '10.6(3s)'
  );
}

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu19799',
  'cmds'    , make_list('show feature')
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['mpls_oam_feature'];

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);