The IT and networking brand Cisco has patched two (2) critical vulnerabilities affecting the NX-OS network operating system, which powers Nexus-series ethernet switches and MDS-series Fibre Channel storage area network switches. If successfully exploited, each vulnerability could induce denial-of-service (DoS) conditions, rendering the devices inoperable. The first flaw, tracked as CVE-2022-20823, was given a CVSS score of 8.6/10, and affects the OSPF version 3 (OSPFv3) feature of Cisco NX-OS, stemming from improper input validation of specific OSPFv3 packets. If exploited, an unauthenticated remote attacker could craft and send malicious OSPFv3 link-state advertisements (LSA) to a vulnerable switch, causing the process itself to crash and restart over and over again, creating a DoS. The second vulnerability, tracked as CVE-2022-20824, is also due to improper input validation, this time within the Cisco Discovery Protocol feature. If exploited, an attacker could craft and send maliciously crafted Discovery Protocol packets to a vulnerable device, allowing attackers to execute arbitrary code with root privileges, as well as induce a DoS through repeated forced crashes and restarts. It should be noted that for CVE-2022-20824 to be exploited, the attackers must have gained access to a device adjacent to the vulnerable switch, meaning that the packets can’t be passed through another device before reaching their target. CTIX analysts urge all organizations leveraging Cisco business routers and switches to ensure that they have installed the latest patch to avoid exploitation.