CVE-2021-1588
📋 TL;DR
An unauthenticated remote attacker can send malicious MPLS echo packets to cause a denial of service on vulnerable Cisco NX-OS devices. This vulnerability affects Cisco Nexus switches and MDS switches running affected NX-OS versions with MPLS OAM enabled. The attack causes the device to reload, resulting in network disruption.
💻 Affected Systems
- Cisco Nexus 3000 Series Switches
- Cisco Nexus 9000 Series Switches in NX-OS mode
- Cisco Nexus 9500 R-Series Line Cards and Fabric Modules
- Cisco MDS 9000 Series Multilayer Switches
📦 What is this software?
Nx Os by Cisco
Nx Os by Cisco
Nx Os by Cisco
⚠️ Risk & Real-World Impact
Worst Case
Complete device reload causing extended network outage and service disruption
Likely Case
Device reload causing temporary network outage until device restarts
If Mitigated
No impact if MPLS OAM is disabled or device is patched
🎯 Exploit Status
Attack requires sending crafted MPLS echo packets to vulnerable interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NX-OS 9.3(9), 10.2(4), and specific releases in other trains
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mpls-oam-dos-sGO9x5GM
Restart Required: Yes
Instructions:
1. Check current NX-OS version. 2. Download appropriate fixed version from Cisco. 3. Follow Cisco NX-OS upgrade procedures. 4. Reload device after upgrade.
🔧 Temporary Workarounds
Disable MPLS OAM
cisco-nxosDisable the MPLS OAM feature to prevent exploitation
configure terminal
no mpls oam
Access Control Lists
cisco-nxosImplement ACLs to restrict MPLS echo packet access
configure terminal
ip access-list ACL_MPLS_OAM
deny udp any any eq 3503
permit ip any any
interface [interface]
ip access-group ACL_MPLS_OAM in
🧯 If You Can't Patch
- Disable MPLS OAM feature if not required
- Implement network segmentation to isolate MPLS interfaces
🔍 How to Verify
Check if Vulnerable:
Check NX-OS version and MPLS OAM configuration statusCheck Version:
show version | include NX-OSVerify Fix Applied:
Verify NX-OS version is patched and device remains stable under MPLS traffic📡 Detection & Monitoring
Log Indicators:
- MPLS OAM process crashes
- Device reload events
- Unexpected system restarts
Network Indicators:
- Unusual MPLS echo packet traffic to MPLS interfaces
- MPLS OAM protocol anomalies
SIEM Query:
source="nxos" AND ("MPLS OAM" OR "reload" OR "crash")