{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:02:53Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-20200226-nxos-bgpmd5","slug":"cisco-sa-20200226-nxos-bgpmd5","vendor":"Cisco","title":"Cisco NX-OS Software Border Gateway Protocol MD5 Authentication Bypass Vulnerability","summary":"A vulnerability in the implementation of Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication in Cisco NX-OS Software could allow an unauthenticated, remote attacker to bypass MD5 authentication and establish a BGP connection with the device. The vulnerability occurs because the BGP MD5 authentication is bypassed if the peer does not have MD5 authentication configured, the NX-OS device does have BGP MD5 authentication configured, and the NX-OS BGP virtual routing and forwarding (VRF) name is configured to be greater than 19 characters. An attacker could exploit this vulnerability by attempting to establish a BGP session with the NX-OS peer. A successful exploit could allow the attacker to establish a BGP session with the NX-OS device without MD5 authentication. The Cisco implementation of the BGP protocol accepts incoming BGP traffic only from explicitly configured peers. To exploit this vulnerability, an attacker must send the malicious packets over a TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the affected system’s trusted network. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5","severity":"Medium","published_at":"2020-02-26T16:00:00Z","updated_at":"2020-02-26T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5/csaf/cisco-sa-20200226-nxos-bgpmd5.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":2,"public_evidence_count":2,"kev_count":0,"highest_epss":0.01278},"cves":[{"id":"CVE-2020-3165","kev":false,"epss":{"score":0.01278,"percentile":0.66785,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"}}],"public_evidence":[{"product":{"name":"Cisco Nexus 3000 Series Switches","slug":"cisco-nexus-3000-series-switches","vendor":"Cisco"},"cve":{"id":"CVE-2020-3165"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:15:13Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco NX-OS Software 9.2(1) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.2(2) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.2(2t) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.2(2v) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.2(3) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.2(3y) when installed on Cisco Nexus 3000 Series Switches; Cisco NX-OS Software 9.3(1) when installed on Cisco Nexus 3000 Series Switches","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.01278,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-02-26T16:00:00Z","updated_at":"2020-02-26T16:00:00Z","advisory_updated_at":"2020-02-26T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5"},"row_display_order":1},{"product":{"name":"Cisco Nexus 9000 Series Switches","slug":"cisco-nexus-9000-series-switches","vendor":"Cisco"},"cve":{"id":"CVE-2020-3165"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:15:13Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco NX-OS Software 9.2(1) when installed on Cisco Nexus 9000 Series Switches; Cisco NX-OS Software 9.2(2) when installed on Cisco Nexus 9000 Series Switches; Cisco NX-OS Software 9.2(3) when installed on Cisco Nexus 9000 Series Switches; Cisco NX-OS Software 9.2(3y) when installed on Cisco Nexus 9000 Series Switches; Cisco NX-OS Software 9.3(1) when installed on Cisco Nexus 9000 Series Switches; Cisco NX-OS Software 9.3(1z) when installed on Cisco Nexus 9000 Series Switches","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.01278,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-02-26T16:00:00Z","updated_at":"2020-02-26T16:00:00Z","advisory_updated_at":"2020-02-26T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-nxos-bgpmd5"},"row_display_order":2}]}