CVE-2026-20010: Cisco NX-OS LLDP DoS Vulnerability

CVE-2026-20010 Overview

A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP process to restart, which could cause an affected device to reload unexpectedly. This vulnerability is due to improper handling of specific fields in an LLDP frame.

An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. LLDP is a Layer 2 link protocol, meaning to exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).

Critical Impact

Successful exploitation allows an unauthenticated adjacent attacker to cause device reloads, resulting in network disruption and denial of service conditions affecting network infrastructure availability.

Affected Products

• Cisco NX-OS Software (LLDP feature enabled)
• Cisco Nexus 3000 Series Switches
• Cisco Nexus 9000 Series Switches (ACI mode)

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-20010 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-20010

Vulnerability Analysis

This vulnerability exists due to improper handling of specific fields in an LLDP frame within Cisco NX-OS Software. The weakness is classified as CWE-805 (Buffer Access with Incorrect Length Value), indicating that the vulnerable code accesses a buffer using a length value that causes it to access memory beyond the bounds of that buffer.

When the LLDP process receives a specially crafted LLDP packet containing malformed field values, the improper handling leads to a crash of the LLDP process. This crash can cascade into an unexpected device reload, causing complete loss of network connectivity through the affected device.

The adjacent network attack vector requirement means the attacker must have Layer 2 adjacency to the target device. This can be achieved through direct physical connection to the device or through logical connectivity such as a Layer 2 tunnel configured to transport LLDP protocol traffic.

Root Cause

The root cause is classified as CWE-805: Buffer Access with Incorrect Length Value. The LLDP frame parsing code in Cisco NX-OS fails to properly validate the length fields within incoming LLDP frames before using them to access buffer contents. When malformed length values are processed, the code attempts to read or write beyond the allocated buffer boundaries, causing memory corruption that leads to process and device instability.

Attack Vector

The attack vector requires adjacent network access (Layer 2 connectivity). An unauthenticated attacker with direct or logical Layer 2 connectivity to the target device can craft malicious LLDP frames with specifically manipulated field values. When these frames are received and processed by the vulnerable LLDP implementation, the improper field handling causes the LLDP process to crash.

The exploitation mechanism involves sending crafted LLDP packets to any interface on the affected device where LLDP is enabled. Since LLDP operates at Layer 2 and does not require any authentication, the attack can be performed by any device with network adjacency. The malicious LLDP frame contains field values that trigger the buffer access vulnerability, leading to process restart and potentially a full device reload.

Detection Methods for CVE-2026-20010

Indicators of Compromise

• Unexpected LLDP process restarts visible in system logs
• Repeated device reloads without clear administrative cause
• Abnormal LLDP frame counts or malformed frame statistics on interfaces
• Syslog messages indicating LLDP process crashes or memory errors

Detection Strategies

• Monitor system logs for LLDP process crash events and unexpected restarts
• Implement network monitoring to detect anomalous LLDP traffic patterns or unusually high LLDP frame rates
• Configure SNMP traps for device reload events and process restart notifications
• Deploy network packet capture on trunk ports to analyze LLDP frame content for malformed fields

Monitoring Recommendations

• Enable detailed LLDP logging on affected Cisco NX-OS devices
• Configure syslog forwarding to a centralized SIEM for correlation of LLDP-related events
• Monitor interface statistics for increases in LLDP frame errors or discards
• Implement alerting on repeated device reloads within short time windows

How to Mitigate CVE-2026-20010

Immediate Actions Required

• Review the Cisco Security Advisory for affected product versions and patch availability
• Assess which devices in your environment have LLDP enabled and may be exposed
• Consider disabling LLDP on interfaces where the protocol is not required
• Implement physical and logical access controls to limit Layer 2 adjacency to affected devices

Patch Information

Cisco has released a security advisory addressing this vulnerability. Administrators should consult the Cisco Security Advisory for specific fixed software versions and upgrade guidance. Apply the recommended software updates during a maintenance window to minimize network disruption.

Workarounds

• Disable LLDP on interfaces where the feature is not operationally required using interface-level configuration
• Implement strict physical security controls to prevent unauthorized Layer 2 access to network devices
• Segment networks to limit the scope of potential Layer 2 adjacency from untrusted devices
• Where possible, use port security features to restrict which devices can connect to switch interfaces

# Disable LLDP on a specific interface (if not required)
interface Ethernet1/1
  no lldp transmit
  no lldp receive

# Verify LLDP status on interfaces
show lldp interface

# Monitor LLDP statistics for anomalies
show lldp traffic