Cisco NX-OS Software Control Plane DoS (cisco-sa-nxos-nscpdos-SnderkC7)

#TRUSTED 11602579ae0acc2d9ada3290cc1294abae59c25116da4f6cdc80802c6f2cd79a0730d70807a9529bbff04741c03f8e70cc84d2d712f531f9dd5f05fca5ca9e6b2091cca2e32f2bc7d9b5a633c1a3832afc99c109cbd41b2edde0df78862b2b4246573ad1e5c429a4c52e389f1bd266f2c46bc465b0a9c085b54fb6af4ce7f410257a5776d2d2f5f5ef942ac594e19ea1f3ef4f2fcd27a127ab0bd6c7aa3d30871619004d7d4f00776e19db905b1b2d523611900db918b8bfce3592174a6a1344fb3aa212ebf7eac51c927cfc97c96e602f890830a80e483baf28545e9e43d55d85f465ee0c457c8f45c90cf82cfbee0ab15b59f448e32df404d7f9d5901ade996c0d5a75e5552d87115299f575d233cbf05e86623d33cb316a18e088bfaae49355308358ff821d61d8d7098167d1256cafc1ad8446f95fd69aa2016eef62d0fdce8367a712c15e6e90f5d58cd37d10f87eb66f0df05b98ad77bbb3557b17fb9641c195d02b3e4678a5dadc8ce633494240397edb4f47cd6591dcaf860afcac5420a334c5066a27001a32c257489cdcc3cf4b3c6ae7d02b4d27db9644562e57556882392b3f58ab1032e7f8f202e41387c77eae7c0a6289cd81d5e2af882ffe261dd91ed0c761ead8ebabd441ed12c94c88c546b8643f960270b840e7d603d520823c163b4f77373bda7e43122da5c11c03e6deca2d0004edc98a3a7857c22b2c
#TRUST-RSA-SHA256 6c3c03c6ee7e23f553bcfafe3c279bfea7abc2e809430f00c62e963ab17801ac254406bdc7c05835e0284d7582ad4111975cba6c1139c3a0cc5610568d4daae95bac6d562bc423be98565c7ebe14a8c903de07168992d0617b91c95d33c03bad4284b4a4537efc13093c594332eb5d856b227e824037f77aa87a9b338c0ea85020283d2c9fc0181c99b17257eefa1793179b497a6b6a9301512b3d5ed0e97c48de61eed7d9d5dafe1f7119567fb94d9c7325526a83c72f88c3d88b338230b23b828c2e453b5c2b86ded1c1d25a3a8c80cabb96c6805957a13eab637fcec64c3cebea1fb3ad9a9818600caf17ff5e71fc2481686b61fe6e316352a3657b064944f36d04dd4f19b4d44b4b63fee9628c52fea74efd91c40f03912c46c192d2e84d6e91c5dea2489f1e42c642ca3916cfc50eaffb00ea1028688cf1f5a3f97d356627d224a56114161172671ceb023661809eaf166b1dc2e6ff69076f23895aa525df975d620bf95a129de0d7f39c8b38e3d1548cad4bc2a6a6d764e4c39023e882c8bf8d4b6c27328ca411e21a1c896ad5b014a1ed64c0a0e1142b321968569199558efa892763306876aefaec2d3ea697941730d75fa6d7c10add480428eddff6cdf20afd4e7ff82bb8470ce6a9e4481e3b38d1beaf61bf60e8d4bf41427eb4eaf6109b44044e2b15d9abd368df5c114a9e00dfd274f6e8ea1e6ee48ee86c7ff8
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363871);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2026-20173");
  script_xref(name:"CISCO-BUG-ID", value:"CSCws28832");
  script_xref(name:"CISCO-BUG-ID", value:"CSCws61989");
  script_xref(name:"CISCO-SA", value:"cisco-sa-nxos-nscpdos-SnderkC7");

  script_name(english:"Cisco NX-OS Software Control Plane DoS (cisco-sa-nxos-nscpdos-SnderkC7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability.

  - A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system
    resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting
    was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high
    rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could
    allow the attacker to cause instability to various routing and control plane protocols through some packet
    loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual
    intervention soon after the high rate of traffic is stopped. (CVE-2026-20173)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?89dd3384");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws28832");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws61989");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCws28832, CSCws61989");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20173");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Settings/ParanoidReport", "Host/Cisco/NX-OS/Device");

  exit(0);
}

include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco NX-OS Software');


if (('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])7[0-9]{2,3}") &&
    ('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])3[0-9]{2,3}") &&
    ('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])9[0-9]{2,3}"))
audit(AUDIT_HOST_NOT, 'affected');

var version_list = [];

if ('Nexus' >< product_info.device && product_info.model =~ "^7[0-9]{2,3}")
{
  version_list = make_list(
    '8.2(7)',
    '8.2(7a)',
    '8.2(8)',
    '8.2(9)',
    '8.2(10)',
    '8.2(11)',
    '8.4(4)',
    '8.4(4a)',
    '8.4(5)',
    '8.4(6)',
    '8.4(6a)',
    '8.4(7)',
    '8.4(8)',
    '8.4(9)',
    '8.4(10)',
    '8.4(11)',
    '8.4(12)'
  );
}

if ('Nexus' >< product_info.device && product_info.model =~ "^3[0-9]{2,3}")
{
  version_list = make_list(
    '9.2(1)',
    '9.2(2)',
    '9.2(2t)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '9.2(2v)',
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(4a)',
    '10.3(4)',
    '10.3(5)',
    '10.3(6)',
    '10.3(7)',
    '10.3(8)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(4)',
    '10.5(5)'
  );
}

if ('Nexus' >< product_info.device && product_info.model =~ "^9[0-9]{2,3}")
{
  version_list = make_list(
    '9.2(1)',
    '9.2(2)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(1z)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(5w)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '9.3(16)',
    '9.3(17)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(99w)',
    '10.3(3w)',
    '10.3(99x)',
    '10.3(3o)',
    '10.3(4a)',
    '10.3(3p)',
    '10.3(4)',
    '10.3(3q)',
    '10.3(3x)',
    '10.3(5)',
    '10.3(4g)',
    '10.3(3r)',
    '10.3(6)',
    '10.3(4h)',
    '10.3(7)',
    '10.3(8)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(4g)',
    '10.4(6)',
    '10.4(7)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(3t)',
    '10.5(3e)',
    '10.5(3o)',
    '10.5(3s)',
    '10.5(4)',
    '10.5(3p)',
    '10.5(5)'
  );
}

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCws28832, CSCws61989',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);