Cisco Smart Install - How to Prevent Attacks on Switches
There’s been a flurry of activity around the Cisco Smart Install feature recently. Last week, we posted a tech blog about CVE-2018-0171, a critical vulnerability in Cisco’s Smart Install feature that called for immediate mitigation as proof-of-concept code was released publicly. Now, a wave of attacks has moved through data centers across the internet targeting Cisco switches with Smart Install in various countries across the globe. This time around, attackers are (mis)using the Smart Install protocol with mal intent on Cisco’s switches that are open with Smart Install support. Once the attacker gains access, they rewrite the Cisco IOS image on the switches and change the configuration file. One such attack leaves a message that reads “Do not mess with our elections” as the message banner. The switch then becomes unavailable.
Impact assessment
According to Cisco Talos, more than 168,000 devices found on Shodan have this vulnerability. The rate at which Cisco switches are being taken down isn’t known at this time. But, the loss of a switch can have a small to enormous impact on a data center, depending on the network architecture. Cisco switches utilized for internet connectivity may cause lost connectivity if they’re taken down. Any business that hasn’t mitigated their switches could experience a loss in connectivity affecting sales, productivity or customer interaction.
Exploitation
According to Cisco, “The Cisco Smart Install protocol can be abused to modify the Trivial File Transfer Protocol (TFTP) server setting, exfiltrate configuration files via TFTP, modify the configuration file, replace the IOS image, and set up accounts, allowing for the execution of IOS commands. Although this is not a vulnerability in the classic sense, the misuse of this protocol is an attack vector that should be mitigated immediately.”
Cisco released an advisory on the security of Smart Install last year and reiterated their advice last week.
Urgently required actions
Cisco and Tenable suggest immediate mitigation of Cisco switches by:
- Limiting access through an Access Control List
- Limiting access to TCP 4786 port
- Disabling the Smart Install Client on the switch
Identifying affected systems
- Cisco has released an open-source tool that scans for devices which use the Cisco Smart Install protocol
- Tenable uses plugin 105161 for Cisco Smart Install detection
Get more information
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Related Articles
Do You Think You Have No AI Exposures? Think Again
August 6, 2024As AI usage becomes more prevalent in organizations globally, security teams must get full visibility into these applications. Building a comprehensive inventory of AI applications in your environment is a first step. Read on to learn what we found about AI application-usage in the real world when we analyzed anonymized telemetry data from scans using Tenable’s products.
Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach
August 6, 2024As AI transforms industries, security remains critical. Discover the importance of a security-first approach in AI development, the risks of open-source tools, and how Tenable's solutions can help protect your systems.
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
- Plugins