Cisco Nexus 3600 External BGP DoS (cisco-sa-nxos-po-acl-TkyePgvL)

high Nessus Plugin ID 191465


The remote device is missing a vendor-supplied security patch


A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability exists because eBGP traffic is mapped to a shared hardware rate-limiter queue. An attacker could exploit this vulnerability by sending large amounts of network traffic with certain characteristics through an affected device. A successful exploit could allow the attacker to cause eBGP neighbor sessions to be dropped, leading to a DoS condition in the network.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.


Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwh09703, CSCwh96478

See Also

Plugin Details

Severity: High

ID: 191465

File Name: cisco-sa-nxos-ebgp-dos-L3QCwVJ.nasl

Version: 1.0

Type: combined

Family: CISCO

Published: 3/1/2024

Updated: 3/1/2024

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information


Risk Factor: Medium

Score: 4.4


Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-20321


Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:nx-os

Required KB Items: Host/Cisco/NX-OS/Version, Host/Cisco/NX-OS/Model, Host/Cisco/NX-OS/Device, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 2/28/2024

Vulnerability Publication Date: 2/28/2024

Reference Information

CVE: CVE-2024-20321

CWE: 400

CISCO-SA: cisco-sa-nxos-ebgp-dos-L3QCwVJ

IAVA: 2024-A-0119

CISCO-BUG-ID: CSCwh09703, CSCwh96478