A service in the Silicon One integration on certain Nexus 9000 switches binds to a routable address, so an unauthenticated attacker who reaches TCP 43210 or 43211 can run code as root on the switch. CVSS 9.8. Cisco has shipped fixed NX-OS. Patch, and prove those ports are not reachable.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Nov 1, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
The switch moving traffic through your data center is a computer too, and this one will run an attacker's code as root if it can reach two TCP ports.
CVE-2026-20212 lives in the Silicon One integration on certain Nexus 9000 switches. A component meant for internal use binds to an unrestricted IP address, so crafted input to TCP 43210 or 43211 executes code with root privileges. No credentials, no user interaction, CVSS 9.8. The same flaw can also crash the S1HAL process and reload the whole switch.
A compromised core switch is a worst-case foothold: it sees traffic for everything behind it, it is trusted by every device around it, and it is rarely instrumented the way servers are. Only Nexus 9000 models with a Silicon One ASIC are affected, which narrows the fleet, but the ones that qualify tend to sit in the most sensitive paths. Cisco found it through a support case and has fixed NX-OS; the work now is confirming which switches are affected and proving those two ports cannot be reached from anywhere an attacker sits.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, unauthenticated root remote code execution flaw on Cisco Nexus 9000 switches equipped with a Silicon One ASIC. A service in the Silicon One integration binds to an unrestricted IP address, so a remote attacker who reaches TCP 43210 or 43211 can execute code as root, or crash the device. Cisco has released fixed NX-OS and a shield for one train. Confirm which switches are Silicon One, patch, and prove the ports are unreachable.
KEY JUDGMENTS
01
Cisco discovered the flaw while resolving a support case and published fixed NX-OS. No public exploitation had been confirmed at the time of writing.Observed
02
Only Nexus 9000 models with a Cisco Silicon One ASIC are affected. Nexus 3000 and 7000, MDS 9000, Firepower and Secure Firewall are not.Reproduced
03
Exposure is reachability to TCP 43210 or 43211 on a locally configured device IP. Management and internal paths that reach those ports are the risk.Assessed
04
A core switch compromise is high-leverage: it observes traffic for everything behind it and is trusted by adjacent devices, so prioritize affected models in sensitive paths.Assessed
Silicon One integration, Cisco NX-OS on Nexus 9000
Weakness
CWE-1327 binding to an unrestricted IP address
Vector
TCP 43210 or 43211, pre-authentication
Affected
Nexus 9000 models with a Silicon One ASIC on vulnerable NX-OS
Scoring
9.8 · CVSS v3.1
Secondary impact
Crash of the S1HAL process and device reload
Impact
Code execution with root privileges on the switch.
EXPOSURE: SILICON ONE, PORTS REACHABLE
01Nexus 9000 with Silicon OneOnly these models are affected.
02Vulnerable NX-OSA build before the fixed release.
03Ports reachableTCP 43210 or 43211 reachable on a device IP.
04Core pathSwitches in sensitive paths are the priority.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDNot confirmedFound via a support case.
SECONDARYDevice reloadCan crash S1HAL and reboot.
SCOPESilicon One onlySpecific Nexus 9000 models.
PATCHAvailableFixed NX-OS and a shield.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Sep 4Cisco discloses CVE-2026-20212 in the Silicon One integration and publishes fixed NX-OS.
Oct 7 to 8Cisco discloses further critical NGOAM and NX-API Nexus flaws, underscoring a run of NX-OS issues.
ContextA China-nexus group has separately targeted Cisco IOS XR routers for persistent implants, raising the stakes for exposed network gear.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Only Nexus 9000 switches with a Silicon One ASIC are affected. Confirm the specific product identifier and the fixed NX-OS train against Cisco's advisory.
PRODUCT
CONDITION
FIXED IN
STATUS
Nexus 9000 with Silicon One ASIC
vulnerable NX-OS
fixed NX-OS per Cisco advisory
Fixed
NX-OS 10.6(3)
if upgrade deferred
shield lp00031 supported
Mitigation
Nexus 9000 without Silicon One
not affected
n/a
Not affected
Nexus 3000/7000, MDS, Firepower
not affected
n/a
Not affected
CONFIRM THE MODELCisco lists the exact vulnerable product identifiers and the fixed NX-OS release per platform. Confirm your switch is a Silicon One model and match the fixed train before scheduling the change.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Silicon One Nexus 9000 in core pathsApply the fixed NX-OS now. These switches see the most sensitive traffic.
Ports 43210 / 43211 reachableRestrict access to those TCP ports from all untrusted and management-adjacent networks.
HighWithin the change window
All affected Silicon One switchesUpgrade to the fixed NX-OS train for the platform.
NX-OS 10.6(3) with deferred upgradeApply the documented shield lp00031 as an interim control.
MonitoringAlert on unexpected S1HAL crashes and device reloads.
HighBefore closing
Every switchRecord the model, ASIC, NX-OS version and port reachability result as evidence.
WORKAROUNDS
Restrict the ports. Block or filter TCP 43210 and 43211 from any network an attacker could reach.Apply the shield. On NX-OS 10.6(3), Cisco supports shield lp00031 as an interim control until you upgrade.Tighten management reachability. Keep switch management and device IPs off paths that untrusted hosts can reach.Alert on reloads. An S1HAL crash and reload can indicate exploitation attempts; make sure it pages someone.
06 · DETECTION AND HUNTING
Observables and hunting queries
Cisco documents syslog signatures when the shield blocks activity. Hunt on those messages, on S1HAL crashes, and on reachability of the two ports.
TYPE
OBSERVABLE
SOURCE
Behavior
%APPMGR-2-NXSECURE_CRIT_THREAT messages tied to the flaw
NX-OS syslog
Behavior
Unexpected S1HAL process crashes or switch reloads
NX-OS syslog, device logs
Exposure
TCP 43210 or 43211 reachable on a device IP
Network scan from management and user segments
EXPOSURE · CVE-2026-20212model, ASIC and version
show version | include "Silicon One|NXOS"
HUNT · CVE-2026-20212shield and S1HAL events
show logging | include "NXSECURE_CRIT_THREAT|S1HAL"
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Assessed
Impact
T1498
Network Denial of Service (S1HAL crash and reload)
Reproduced
08 · TECHNICAL ANALYSIS
Root cause and attack path
The flaw is in the Silicon One integration on affected Nexus 9000 switches, classed as CWE-1327, binding to an unrestricted IP address. A component that should only be reachable locally instead listens on a device IP, exposing TCP ports 43210 and 43211. Crafted input to those ports lets an unauthenticated attacker execute code with root privileges on the switch. The same path can crash the S1HAL process and reload the device, a denial of service.
Only Nexus 9000 models with a Cisco Silicon One ASIC are affected; other Nexus, MDS and Firepower products are not. Cisco found the issue while working a Technical Assistance Center support case and shipped fixed NX-OS, plus a shield (lp00031) for NX-OS 10.6(3) that generates a critical NXSECURE syslog when it blocks activity. The practical exposure is reachability: a switch is at risk when an attacker can route to those two ports on a device IP, so restricting them and patching are the two halves of the response.
01 REACH
Attacker routes to TCP 43210 or 43211 on a device IP
NX-API Nexus flaw from the same October advisory cluster.
AssessedA core switch that runs attacker code as root over two TCP ports is a foothold with a view of everything behind it. Reachability control and patching are both required.
09 · VALIDATION
Confirm remediation
A model list is not a verdict. Each affected switch should end with evidence: fixed NX-OS running, and the two ports unreachable from untrusted networks.
01
Identify Silicon One switches
Only these Nexus 9000 models are affected.
show version | include "Silicon One|NXOS"
02
Confirm the fixed NX-OS
Compare the running version against Cisco's fixed train for the platform.
# compare show version to the Cisco advisory fixed release
03
Test port reachability
From management and user segments, confirm 43210 and 43211 are not reachable.
# in scope: nc -vz <device-ip> 43210 and 43211 should fail from untrusted networks
04
Confirm the shield where used
On NX-OS 10.6(3) with deferred upgrade, confirm shield lp00031 is active.
show logging | include "NXSECURE_CRIT_THREAT"
05
Alert on crashes
Make sure S1HAL crashes and device reloads page the network team.
# verify monitoring alerts on S1HAL crash and unplanned reload
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-20212
01Do you run Nexus 9000 switches with a Cisco Silicon One ASIC?
02Is the NX-OS version below the fixed release for that platform?
03Are TCP ports 43210 or 43211 reachable on a device IP from any untrusted network?
04Would your monitoring catch an unexpected S1HAL crash or device reload?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Cisco security advisory: Nexus 9000 Silicon One RCE (CVE-2026-20212)
›NVD: CVE-2026-20212
›SOC Prime analysis of CVE-2026-20212
›Cisco NGOAM and NX-API Nexus advisories, October 2026
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Which switches are affected by CVE-2026-20212?
Only Nexus 9000 models with a Cisco Silicon One ASIC on a vulnerable NX-OS build. Nexus 3000, 7000, MDS 9000, Firepower and Secure Firewall are not affected.
Is it being exploited?
Cisco found it via a support case and no public exploitation was confirmed at the time of writing. The CVSS is 9.8, so treat it as urgent.
How is it reached?
Through TCP ports 43210 or 43211 on a locally configured device IP, with no authentication. Restricting those ports reduces exposure.
Is there a mitigation if I cannot upgrade immediately?
On NX-OS 10.6(3), Cisco supports shield lp00031 as an interim control, alongside restricting the ports.
VALIDATE YOUR EXPOSURE
Prove your network device exposure
Hayrok inventories your Nexus fleet, flags Silicon One models on vulnerable NX-OS, and tests whether the two exposed ports are reachable from untrusted networks. Every result lands in Evidence Fabric.