Proof of Concept (and Patch) for Critical Cisco IOS Vulnerability: CVE-2018-0171
Embedi, a security firm, has discovered a major security flaw in the Cisco Smart Install code. According to Embedi and Cisco, “A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.”
Smart Install is Cisco’s quick configuration method for their switches. Cisco states that in a Smart Install network, you can use the Zero-Touch Installation process to install new access layer switches to the network without assistance from the network administrator. In other words, you can ship a switch to a location, place it in the network and power it on without configuring the switch.
Impact assessment
A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could then: trigger a reload of the device, allow the attacker to execute arbitrary code on the device or cause an indefinite loop on the affected device that triggers a watchdog crash.
In a properly configured network environment, Smart Install technology participants should not be accessible through the internet. However, Embedi conducted a scan and detected “250,000 vulnerable devices and 8.5 million devices that have a vulnerable port open” to the internet. Compromised switches will lead to further degraded network security and reliability – and increased cyber risk.
Exploitation
A remote, unauthenticated attacker can exploit a flaw in the client to reload an affected device and cause denial of service or execute arbitrary code. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786.
Urgently required actions
Embedi has published proof-of-concept exploit code, and network administrators should immediately patch all Cisco devices.
Cisco has released a patch for this critical bug CVE-2018-0171 affecting Smart Install.
As more analysis is done across networks containing the vulnerability, Tenable suggests immediate patching. If a system is exploited, any system reboot will cause network outages.
Cisco devices configured as a Smart Install director are not affected by this vulnerability. Tenable suggests checking with Cisco for more information about specific Cisco devices.
Identifying affected systems
Tenable released the following plugins to identify affected systems.
- Nessus Plugin 108722 Cisco IOS Software Smart Install Remote Code Execution Vulnerability
- Nessus Plugin 108723 Cisco IOS XE Software Smart Install Remote Code Execution Vulnerability
Get more information
- Cisco Security Advisory
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Related Articles
Do You Think You Have No AI Exposures? Think Again
August 6, 2024As AI usage becomes more prevalent in organizations globally, security teams must get full visibility into these applications. Building a comprehensive inventory of AI applications in your environment is a first step. Read on to learn what we found about AI application-usage in the real world when we analyzed anonymized telemetry data from scans using Tenable’s products.
Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach
August 6, 2024As AI transforms industries, security remains critical. Discover the importance of a security-first approach in AI development, the risks of open-source tools, and how Tenable's solutions can help protect your systems.
CloudImposer: Executing Code on Millions of Google Servers with a Single Malicious Package
September 16, 2024Tenable Research discovered a remote code execution (RCE) vulnerability in Google Cloud Platform (GCP) that is now fixed and that we dubbed CloudImposer. The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool. Tenable Research also found risky guidance in GCP documentation that customers should be aware of.
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
Microsoft’s September 2024 Patch Tuesday Addresses 79 CVEs (CVE-2024-43491)
September 10, 2024Microsoft addresses 79 CVEs with seven critical vulnerabilities and four zero-day vulnerabilities, including three that were exploited in the wild.
- Plugins