CVE-2025-20262: Cisco Nexus Switches PIM6 DoS Vulnerability

CVE-2025-20262 Overview

CVE-2025-20262 is a denial-of-service vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 and Cisco Nexus 9000 Series Switches running in standalone NX-OS mode. An authenticated, low-privileged, remote attacker can crash the PIM6 process by sending a crafted ephemeral data query. The flaw is tracked under CWE-476: NULL Pointer Dereference.

Critical Impact
Successful exploitation crashes the PIM6 process, causing PIM6 adjacency flaps and a denial of service for IPv6 multicast routing and ephemeral query handling on affected switches.

Affected Products

Cisco Nexus 3000 Series Switches (standalone NX-OS mode)
Cisco Nexus 9000 Series Switches (standalone NX-OS mode)
Devices with the PIM6 feature enabled and NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry exposed

Discovery Timeline

2025-08-27 - CVE-2025-20262 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20262

Vulnerability Analysis

The vulnerability resides in how the PIM6 process on Cisco NX-OS parses ephemeral data queries submitted through programmatic management interfaces. When an attacker submits a malformed query, the PIM6 process fails to validate an internal object reference and dereferences a null pointer. The process then crashes and restarts.

Because PIM6 maintains neighbor adjacencies for IPv6 multicast routing, a crash disrupts multicast forwarding state and can trigger adjacency flaps on connected routers. The ephemeral query subsystem also stops servicing requests until the process is restored, impacting operational tooling that depends on model-driven interfaces.

Exploitation requires valid credentials with low privileges, which limits exposure to authenticated users on the management plane. However, environments that expose NX-API or gRPC to broad administrative populations face increased risk.

Root Cause

The root cause is improper processing of PIM6 ephemeral data queries, resulting in a NULL pointer dereference [CWE-476] inside the PIM6 process. Input validation does not account for the crafted query structure before the pointer is used.

Attack Vector

An authenticated attacker sends a crafted ephemeral query to an affected device through one of the following management interfaces: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. The attack is network-reachable and requires only low-privileged credentials. No user interaction is required.

No verified public exploit code is available. For protocol-level details, refer to the Cisco Security Advisory.

Detection Methods for CVE-2025-20262

Indicators of Compromise

Unexpected PIM6 process crashes or restarts logged in NX-OS system messages (PIM6 or pim6 service events).
PIM6 neighbor adjacency flaps correlated with inbound NX-API, NETCONF, RESTConf, gRPC, or telemetry traffic.
Repeated malformed ephemeral queries originating from a single authenticated session or source IP.

Detection Strategies

Monitor NX-OS syslog for PIM6 process termination events and crash core generation.
Review API access logs for NX-API REST, NETCONF, RESTConf, and gRPC to identify authenticated users issuing unusual ephemeral queries.
Correlate management-plane query volume with multicast routing instability on IPv6 segments.

Monitoring Recommendations

Centralize NX-OS syslog and AAA accounting records into a SIEM or data lake for correlation across management interfaces.
Alert on process restart counters for PIM6 exceeding baseline over short windows.
Baseline normal programmatic query patterns and flag deviations by source identity.

How to Mitigate CVE-2025-20262

Immediate Actions Required

Review Cisco's advisory for fixed NX-OS releases and plan upgrades for affected Nexus 3000 and Nexus 9000 Series Switches.
Restrict management-plane access so that only trusted administrative hosts can reach NX-API, NETCONF, RESTConf, gRPC, and telemetry endpoints.
Audit NX-OS user accounts and remove unnecessary low-privileged accounts that can submit ephemeral queries.

Patch Information

Cisco has published fixed software releases and remediation guidance in the Cisco Security Advisory cisco-sa-nxospc-pim6-vG4jFPh. Apply the vendor-supplied NX-OS updates that correspond to your platform and train.

Workarounds

Disable the PIM6 feature on devices that do not require IPv6 multicast routing.
Apply control-plane and management-plane ACLs to limit which hosts can reach NX-API, NETCONF, RESTConf, gRPC, and Model Driven Telemetry services.
Enforce least privilege through NX-OS role-based access control to reduce the population of accounts able to submit ephemeral queries.