Cisco IOS XE Smart Install Protocol Misuse (cisco-sr-20170214-smi)

info Nessus Plugin ID 99234

Language:

Synopsis

The Smart Install feature is enabled on the remote Cisco IOS XE device.

Description

The remote Cisco IOS XE device has the Smart Install Feature enabled.
The Smart Install (SMI) protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients (IBC) and the director can allow a client to process crafted SMI protocol messages as if these messages were from the Smart Install director. An unauthenticated, remote attacker can exploit this to perform the following actions :

- Change the TFTP server address on the IBC.

- Copy arbitrary files from the IBC to an attacker-controlled TFTP server.

- Substitute the client's startup-config file with a file that the attacker prepared and force a reload of the IBC after a defined time interval.

- Load an attacker-supplied IOS XE image onto the IBC.
- Execute high-privilege configuration mode CLI commands on an IBC, including do-exec CLI commands.

Solution

Disable the Smart Install feature.

Plugin Details

Severity: Info

ID: 99234

File Name: cisco-sr-20170214-smi-iosxe.nasl

Version: 1.5

Type: combined

Family: CISCO

Published: 4/6/2017

Updated: 5/3/2024

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/o:cisco:ios_xe

Required KB Items: Host/Cisco/IOS-XE/Version

Vulnerability Publication Date: 2/14/2017

Detections

Analytics