CVE-2026-20010
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-20010 is a high-severity Buffer Access with Incorrect Length Value (CWE-805) vulnerability in Cisco NX-OS Software (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20010 is a vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software. The issue arises from improper handling of specific fields in an LLDP frame, which could allow an unauthenticated, adjacent attacker to cause the LLDP process to restart. This may result in an affected device reloading unexpectedly, creating a denial-of-service (DoS) condition. The vulnerability is associated with CWE-805 and has a CVSS v3.1 base score of 7.4 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
An unauthenticated attacker with adjacent network access can exploit this vulnerability by sending a crafted LLDP packet to an interface on an affected device. LLDP operates as a Layer 2 protocol, so the attacker must be directly connected to the target interface, either physically or logically—for example, via a Layer 2 tunnel configured to transport LLDP frames. Successful exploitation causes the device to reload, disrupting network operations.
Mitigation details and affected versions are outlined in the Cisco Security Advisory available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k_aci_lldp_dos-NdgRrrA3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8664
Vulnerability Data
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP process to restart, which could cause an affected device to reload unexpectedly. This vulnerability is due…
more
to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and static analysis) directly finds incorrect length values used in sequential buffer accesses.
Secure engineering principles require explicit bounds checking and correct length calculations when performing buffer operations.
Input validation rejects or corrects malformed length values supplied from external sources before they reach buffer operations.
Memory protection mechanisms limit the blast radius when an incorrect length value causes an out-of-bounds access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect out-of-bounds accesses, but does not guarantee prevention.
Secure development life cycle mandates buffer-safety practices that directly prevent incorrect length values.
Application security requirements can specify buffer-size validation, but do not prescribe implementation details.
Secure architecture principles encourage bounds-checked APIs, yet leave concrete coding decisions to developers.
Secure coding explicitly requires correct buffer-length handling, eliminating CWE-805 when followed.