Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)

#TRUSTED 40bcf3ff6a6b58c7d7b7d1143780cd490f87a7e9cd42de47832b8f6017abfffe1bef6b82921c096f9c3855a04dea9885189161b1bd9ba66d66bcb3e4ca962565711bda01c052a54a961c49467e71e4241be0f910b6447f358b0cae1e6428e8bcd48e03bc71d5b2958cf1eb46066c99cfd709d6069f71389b5ba1bd114c6adb85f0ea02305e0cbd2cf85f5f13dc3d054ee519dfb1fb09e704e9063c06421d37c1366296a0e43e96404ef54117ee444d8089dac30cce6b8d57ef4cc446f87a922ac471b2b1e6761eba36e325662efe15eaa1cb648b0fb42222f52bad6d024c41ff95080d28de74ab4c326c47d28dfca5c252a59ca00b514b88eebb75bbdd519ac233687579064ecb980e05ee5d09613efbd2fc457d099c69b6b0309c9aa5fb5255c24f3f54ee31c10261130247ad170280f0bd6116d0776707fb94db6fce3369615a2f7654b6c1d64c435f6db00bf2a48d12a29b3583309aa61f4e4c72c6e8f2355cc172335ac54a0bdb96b94617c2119cd9782e36e463286d68394ad807cf87acd680463bff08bc1945775ca629e1264ed330e441163766413b43fde3a756d954a02333f78ddf719fb43569f4e34ea23d392cce9066b1eec72f1b32629d1e70bc11912ed6c6469c87887698fe3f05a4ee32d3c723f7016b9a5e6aaa753c463b52f20863385b35323301fdf0c51007764a13af985dc1a09e3cb6c787a6900545af
#TRUST-RSA-SHA256 a23a4f98254eb6c5eb9d09d89ada4a62f6fba5daf58ea0de9925d4ebd994a1ee9b480a6c7f2b6cee5f8badb72c4e45e16b96bd0a4ce77d573e54148fe151ba5d5e824ed792860dc4e84e42620dffeec6593e816d89ba9519052e4d2a4d493c97af82d1576b9f333fdc53bd9a8e5c351b1e5d186dbeebbff836fe6766a492bda111150e499cb987aecea3a217ff9d1f26836aa8337480f645206e291279b8ed7251f49f7a31dc6fd63de9fe6d33187b2a8e8636e3445d5b7f3db7179994c13869502ec8b2470e7c6b6403816eb58b0a5f70589c8aae1a33822ea408afb5eb3aa3bdadcefce321d1dd0334e65b5e39ca70de263a3e7603804e2d5f4b113dd79fd3c925897c09f91e4b4fd03fdf69450500e4b20b3a17b1b2c65d1d0e02755d7b98541164c7b20c57518a1d4c70121da9d5561fdda474a24642e1f50997995ba437857b61b8943695a66fb4e1c931ce30a308ff31ad46fd895f6a07733e209430c8aef8c20932c85c3838d6cf3f50aa6a0101ca2e77974ac6a481b1a420b649b31b57e57cec42d597a6859329704f6c046b3a7d0aecfe7b41473ed4744d553a37cadce8cd1e822c1013badf49ec2ab1d050667caaa1bcbbf3ed82209dbb57709d42c682176c9a1bd3e05af27ac1aea35385292a24831a9df766ae762154f30d18e6ca1b9c4a10b39f056dcf05617153454006fee997fbdf9d085747554c5781f7ad
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364501);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id("CVE-2026-76471");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu46199");
  script_xref(name:"CISCO-SA", value:"cisco-sa-napi-rce-r2shwu2j");
  script_xref(name:"IAVA", value:"2026-A-1091");

  script_name(english:"Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability.

  - A heap-based buffer overflow condition exists in the NX-API feature due to insufficient input validation
    of data sent to the NX-API. An unauthenticated, remote attacker can exploit this, by sending a specially
    crafted HTTP request, to execute arbitrary code with root privileges or cause a denial of service
    condition. (CVE-2026-76471)

Please see the included Cisco BID and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2639971d");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu46199");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu46199.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76471");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(122);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Host/Cisco/NX-OS/Device", "Settings/ParanoidReport");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco NX-OS Software');


if (('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])3[0-9]{2,3}") &&
    ('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])9[0-9]{2,3}"))
audit(AUDIT_HOST_NOT, 'affected');

var version_list = [];

if ('Nexus' >< product_info.device && product_info.model =~ "(^|[^0-9])3[0-9]{2,3}")
{
  version_list = make_list(
    '9.2(1)',
    '9.2(2)',
    '9.2(2t)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '9.2(2v)',
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(4a)',
    '10.3(4)',
    '10.3(5)',
    '10.3(6)',
    '10.3(7)',
    '10.3(8)',
    '10.3(9)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(4)',
    '10.5(5)',
    '10.6(1)',
    '10.6(2)',
    '10.6(3)'
  );
}

if ('Nexus' >< product_info.device && product_info.model =~ "(^|[^0-9])9[0-9]{2,3}")
{
  version_list = make_list(
    '9.2(1)',
    '9.2(2)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '9.3(1)',
    '9.3(1z)',
    '9.3(2)',
    '9.3(3)',
    '9.3(4)',
    '9.3(5)',
    '9.3(5w)',
    '9.3(6)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(99w)',
    '10.3(3w)',
    '10.3(99x)',
    '10.3(3o)',
    '10.3(4a)',
    '10.3(3p)',
    '10.3(4)',
    '10.3(3q)',
    '10.3(3x)',
    '10.3(5)',
    '10.3(4g)',
    '10.3(3r)',
    '10.3(6)',
    '10.3(4h)',
    '10.3(7)',
    '10.3(8)',
    '10.3(9)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(4g)',
    '10.4(5)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(3t)',
    '10.5(3e)',
    '10.5(3o)',
    '10.5(3s)',
    '10.5(4)',
    '10.5(3p)',
    '10.5(5)',
    '10.6(1)',
    '10.6(1s)',
    '10.6(2)',
    '10.6(2s)',
    '10.6(2n)',
    '10.6(3)',
    '10.6(3s)'
  );
}

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu46199'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['nxos_nxapi_feature'];

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);