CVE-2021-1361: Cisco NX-OS RCE Vulnerability

CVE-2021-1361 Overview

A vulnerability exists in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode running Cisco NX-OS Software. This vulnerability allows an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. The flaw stems from TCP port 9075 being incorrectly configured to listen and respond to external connection requests, enabling attackers to manipulate critical system files without authentication.

Critical Impact

Remote unauthenticated attackers can create, delete, or overwrite arbitrary files with root privileges, potentially adding unauthorized user accounts or modifying device configuration without administrator knowledge.

Affected Products

• Cisco NX-OS Software versions 9.3(5) and 9.3(6)
• Cisco Nexus 3000 Series Switches (including 3100, 3100-Z, 3100V, 3200, 3400, 3500, 3600)
• Cisco Nexus 9000 Series Switches in standalone NX-OS mode (including 9000V, 92xxx, 93xxx, 9508)

Discovery Timeline

• February 24, 2021 - CVE-2021-1361 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-1361

Vulnerability Analysis

This vulnerability is classified under CWE-552 (Files or Directories Accessible to External Parties). The core issue lies in the improper exposure of an internal file management service that should only be accessible locally. The service running on TCP port 9075 was designed for internal device operations but was incorrectly configured to accept external connections.

The vulnerability enables network-based attacks without requiring any authentication or user interaction. An attacker who can reach the affected port can directly interact with the file management service, gaining the ability to create new files, delete existing files, or overwrite files—all with root-level privileges. This level of access could allow an attacker to add rogue user accounts to the device, modify startup configurations, or corrupt critical system files resulting in denial of service.

Root Cause

The root cause of CVE-2021-1361 is an insecure default configuration in the internal file management service. TCP port 9075, which hosts this service, was incorrectly bound to listen on all network interfaces rather than being restricted to localhost or internal management interfaces only. This misconfiguration exposes what should be an internal-only service to external network traffic, violating the principle of least privilege and creating a direct attack surface for remote adversaries.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted TCP packets to TCP port 9075 on any IP address configured on a local interface of the vulnerable switch. The attack requires network connectivity to the target device but does not require authentication, prior access, or user interaction. The exploitation process involves:

1. Identifying a vulnerable Cisco Nexus 3000 or 9000 Series Switch running affected NX-OS versions
2. Establishing a TCP connection to port 9075 on the device's management or data plane IP address
3. Sending crafted requests to the file management service to create, delete, or modify files
4. Leveraging root-level file access to achieve persistence (e.g., adding user accounts) or cause disruption

The attack can be executed from anywhere on the network that has IP connectivity to the switch, making internet-facing management interfaces particularly vulnerable.

Detection Methods for CVE-2021-1361

Indicators of Compromise

• Unexpected TCP connections to port 9075 from external IP addresses
• Unauthorized user accounts appearing in device configuration
• Unexplained modifications to configuration files or system binaries
• Anomalous file creation or deletion activity in system directories
• Logs showing connection attempts to the internal file management service

Detection Strategies

• Monitor network traffic for connections to TCP port 9075 on Nexus switch management and data interfaces
• Implement intrusion detection rules to alert on traffic patterns associated with the file management protocol
• Regularly audit device configurations for unauthorized changes, especially user account additions
• Compare running configurations against known-good baselines to identify unauthorized modifications

Monitoring Recommendations

• Deploy network monitoring to track all connections to TCP port 9075 across the Nexus switch infrastructure
• Configure SIEM alerts for any external connection attempts to port 9075 on network devices
• Implement file integrity monitoring on critical Nexus switch configuration files where possible
• Review device logs regularly for signs of unauthorized administrative actions

How to Mitigate CVE-2021-1361

Immediate Actions Required

• Apply the security patches provided by Cisco for affected NX-OS versions immediately
• Block external access to TCP port 9075 using access control lists (ACLs) on management interfaces
• Review device configurations for any unauthorized user accounts or configuration changes
• Isolate management interfaces from untrusted network segments

Patch Information

Cisco has released security updates to address this vulnerability. Organizations should consult the Cisco Security Advisory for specific fixed software versions and upgrade guidance. The advisory provides detailed instructions on determining exposure and obtaining the appropriate patches for Cisco Nexus 3000 and 9000 Series Switches.

Workarounds

• Apply infrastructure ACLs (iACLs) to restrict external access to TCP port 9075 on all vulnerable switches
• Segment management networks to prevent unauthorized access from untrusted network zones
• Implement strict firewall rules blocking port 9075 at network boundaries
• Use out-of-band management networks isolated from production traffic

# Example ACL to block external access to TCP port 9075
# Apply to management interface on Cisco NX-OS
ip access-list block-port-9075
  10 deny tcp any any eq 9075
  20 permit ip any any

# Apply ACL to management interface
interface mgmt0
  ip access-group block-port-9075 in