Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-20262 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxospc-pim6-vG4jFPh	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	[email protected]

Affected Products

Product	Versions
Cisco Nexus 3000	All versions
CPE cpe:2.3:h:cisco:nexus_3000:::::::: cpe:2.3:h:cisco:nexus_3000_series:::::::: Remediation No remediation found in references.
Cisco Nexus 9000	All versions
CPE cpe:2.3:o:cisco:nexus_9000_firmware:::::::: cpe:2.3:h:cisco:nexus_9000:::::::: cpe:2.3:h:cisco:nexus_9000v:::::::: cpe:2.3:h:cisco:nexus_9500:::::::: cpe:2.3:o:cisco:nexus_9500_firmware:::::::: Remediation No remediation found in references.

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Aug 27, 2025	New CVE Received	[email protected]