Security readout for executives and security teams
Plain-English summary
This vulnerability can let a remote unauthenticated attacker make affected Cisco Nexus 9000 ACI leaf switches stop handling critical control traffic. The business impact is network fabric disruption, not data theft. Recovery may require manually power-cycling the device, which increases outage duration and operational risk.
Executive priority
Treat as high priority for environments relying on Cisco ACI fabric availability. The issue affects uptime and recovery operations, and a successful event could require hands-on power cycling rather than ordinary service restart.
Technical view
Cisco describes mishandling of ingress TCP traffic to a specific port on an SVI in Nexus 9000 ACI mode. Packets can cause a queue to buffer network data without processing it, creating a queue wedge that drops control plane traffic and can remove leaf switches from the fabric.
Likely exposure
Exposure is limited to Cisco Nexus 9000 Series fabric switches running Cisco NX-OS System Software in ACI Mode with relevant SVIs reachable by an attacker. The provided sources do not identify specific affected release ranges.
Exploitation context
The CVSS vector indicates network access, low complexity, no privileges, and no user interaction. The source bundle does not show CISA KEV listing or cited evidence of active exploitation in the wild.
Researcher notes
The provided evidence supports denial of service through resource mishandling, mapped to CWE-772. Key unknowns in the bundle are exact affected versions, fixed releases, and whether practical exploitation has been observed outside Cisco's advisory.
Mitigation direction
- Check Cisco's advisory for fixed software and vendor-supported mitigations.
- Prioritize remediation for internet- or untrusted-network-reachable ACI leaf SVIs.
- Limit untrusted TCP reachability to exposed SVIs where architecture permits.
- Plan maintenance carefully because recovery may require a power cycle.
Validation and detection
- Inventory Nexus 9000 switches running NX-OS in ACI Mode.
- Compare installed software against Cisco's affected and fixed-release guidance.
- Identify SVIs reachable from untrusted or user-controlled networks.
- Review fabric health for unexpected leaf removal or control plane disruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-772: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-1523 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- 20210825 Cisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Resource after Effective Lifetime
Missing Release of Resource after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.