# MA-1284.032025: MyCERT Advisory - DoS Vulnerability in Cisco Nexus 3000 and 9000 Series Switches

**Date:** 12 Mar 2025  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1284.032025  
**Advisory ID:** MA-1284.032025

---

**1.0 Introduction**
Recently, A vulnerability has been identified in the health monitoring diagnostics of Cisco Nexus 3000 and 9000 Series Switches operating in standalone NX-OS mode.
**2.0 Impact**
This vulnerability could allow an unauthenticated, adjacent attacker to trigger a device reload, leading to a denial of service (DoS) condition (**CVE-2025-20111)**.
**3.0 Affected Systems**
- Nexus 3100 Series Switches
- Nexus 3200 Series Switches
- Nexus 3400 Series Switches
- Nexus 3600 Series Switches
- Nexus 9200 Series Switches in standalone NX-OS mode
- Nexus 9300 Series Switches in standalone NX-OS mode
- Nexus 9400 Series Switches in standalone NX-OS mode
**4.0 Indicator of Compromise4.1 L2ACLRedirect Loopback Test**
- SWITCH %$ VDC-1 %$ %DIAG\_PORT\_LB-2-L2ACLREDIRECT\_LOOPBACK\_TEST\_FAIL: Module:1 Test:**L2ACLRedirect** Loopback failed 10 consecutive times. Faulty module: affected ports:1  Error:Loopback test failed. Packets lost on the SUP in the receive direction
**4.2 RewriteEngineLoopback Test**
- SWITCH %$ VDC-1 %$ %DIAG\_PORT\_LB-2-REWRITE\_ENGINE\_LOOPBACK\_TEST\_FAIL: Module:1 Test:**RewriteEngine** Loopback failed 10 consecutive times. Faulty module:  Error:Loopback test failed. Packets lost on the SUP in the receive direction
**5.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review [Cisco Security Advisories](https://sec.cloudapps.cisco.com/security/center/publicationListing.x) for more information and apply the necessary updates.
Kindly refer to the following URLs for more information:
- <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k-healthdos-eOqSWK4g>
Generally, CyberSecurity Malaysia advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**6.0 References**
- <https://sec.cloudapps.cisco.com/security/center/publicationListing.x>
- <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k-healthdos-eOqSWK4g>
- <https://nvd.nist.gov/vuln/detail/CVE-2025-20111>