Field Notice: FN74446 - Cisco Crosswork Network Controller Allows Sync-to Command with an Empty Cisco NSO Configuration, Resulting in a Device Outage - Software Upgrade Recommended

Available Languages

Updated:November 6, 2026
Document ID:FN74446

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

High
Impact Rating:
High
First Published:
2026-Nov-06
Last Published:
2026-Nov-06
Revision:
1.0
Cisco Bug IDs:

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected


Affected Product Name Description Comments
CNC-SW-SBP-K9 CNC Software  



Affected Software Product Affected Release Affected Release Number Comments
Crosswork Network Controller 7 7.2.1  

Defect Information


Defect IDHeadline
CSCww18123CNC 7.2 sync-to with an empty NSO configuration can delete the IOS XR default SDR and render the router unbootable

Problem Description


In certain edge-case scenarios, onboarding a device and executing a sync-to command from the Cisco Crosswork Network Controller (CNC) platform may result in an unintended outage and loss of the entire running configuration of the device.


Background


In the normal device onboarding process, Cisco CNC captures the running configuration of the device, and the Network System Orchestrator (NSO) stores the configuration. Any execution of the sync-to command loads the running configuration normally.

However, under certain edge-case scenarios, NSO may be unable to load the running configuration for the onboarded device, or the running configuration may be null. Under this condition, executing the sync-to command will clear the running configuration of the device, preventing NSO from reaching the device. The device may not boot and may require manual intervention. It may be necessary to connect to the physical command console port of the device to boot, reload, and restore the running configuration.

In certain documentation, the initial mitigation for this risk recommended using role-based access control (RBAC) to restrict sync-to functions. However, this approach limited the ability of operators to use the sync-to capability for legitimate use cases. To address this, a targeted patch was developed to maintain sync-to functionality while preventing the deployment of a null configuration to network devices.


Problem Symptom


After the sync-to command is used from the Cisco CNC platform, NSO losses the entire running configuration of the onboarded device and losses connectivity to the device. Some level of outage may result.


Workaround/Solution


For customers who require enhanced protection beyond restricting the sync-to functions with RBAC, a targeted patch for Cisco CNC Release 7.2.1SP is now available upon request. This patch implements a validation check to verify that a valid configuration exists for the target device before initiating a sync-to request. If no configuration is detected, Cisco CNC will trigger an error instead of proceeding with the sync-to operation, effectively preventing the overwrite of the running configuration.


How to Identify Affected Products


This issue affects all releases of Cisco CNC that lack the patch if RBAC has not been configured to prevent Cisco CNC from using the sync-to function.


Revision History


VersionDescriptionSectionDate
1.0Initial Release—2026-NOV-06

For More Information

For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:

Receive Email Notification About New Field Notices

To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products