Firepower Extensible Operating SystemOperating system · Cisco
CVE-2017-3883
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability in the authentication, authorization, and accounting (AAA) implementation of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability occurs because AAA processes prevent the NX-OS System Manager from receiving keepalive messages when an affected device receives a high rate of login attempts, such as in a brute-force login attack. System memory can run low on the FXOS devices under the same conditions, which could cause the AAA process to unexpectedly restart or cause the device to reload. An attacker could exploit this vulnerability by performing a brute-force login attack against a device that is configured with AAA security services. A successful exploit could allow the attacker to cause the affected device to reload. This vulnerability affects the following Cisco products if they are running Cisco FXOS or NX-OS System Software that is configured for AAA services: Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, Multilayer Director Switches, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, Unified Computing System (UCS) 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCuq58760, CSCuq71257, CSCur97432, CSCus05214, CSCux54898, CSCvc33141, CSCvd36971, CSCve03660.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThis is a denial-of-service vulnerability in Cisco FXOS and NX-OS where AAA processes consume excessive resources during brute-force login attacks, preventing the NX-OS System Manager from receiving keepalive messages. This causes system memory depletion on FXOS devices and triggers unexpected AAA process restarts or device reloads on affected Nexus switches and UCS fabric interconnects.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Firepower Extensible Operating SystemOperating system
<= 2.3
FxosOperating system
= 2.3
Nx OsOperating system
= 5.2= 6.2= 6.3= 7.3= 8.1= 8.2<= 4.1<= 6.0= 7.0= 7.0\(3\)i3\(1\)<= 5.2= 7.1\(0.1\)CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify device model and software versionRun 'show version' on the device CLI to obtain the exact version of FXOS or NX-OS installedAffected if The displayed version matches any of the affected versions: FXOS <= 2.3, NX-OS 5.2, 6.2, 6.3, 7.3, 8.1, 8.2, <=4.1, <=6.0, 7.0, 7.0(3)i3(1), <=5.2, or 7.1(0.1)
-
Confirm AAA is enabledRun 'show aaa authentication' and 'show aaa authorization' to verify AAA processes are active on the deviceAffected if AAA authentication or authorization is enabled (vulnerability only triggers when AAA processes are running)
-
Check for AAA rate limiting configurationRun 'show running-config | include aaa' to review AAA configuration, then check for rate-limit or lockout settings using 'show aaa lockout' if availableAffected if No rate limiting, account lockout, or login attempt throttling is configured for AAA authentication failures
-
Check for suspicious AAA process behaviorRun 'show process cpu history' and 'show system internal memory' to monitor AAA process resource consumption over timeAffected if AAA processes show abnormally high CPU or memory usage, or the System Manager keepalive messages are failing
You are affected if your Cisco FXOS or NX-OS device runs an affected version (as listed above) AND has AAA enabled, with no rate limiting or account lockout protections configured to mitigate brute-force login attempts.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply Cisco patches for the affected FXOS/NX-OS versions (refer to Cisco Bug IDs) and implement AAA rate limiting, account lockout policies, or network access controls to limit exposure to unauthenticated login attempts.
Fix this in Firepower Extensible Operating System
Scoped from the published advisory
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2017-3883 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2017-3883 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data