Cisco Smart Install – How to Prevent Attacks on Switches

There’s been a flurry of activity around the Cisco Smart Install feature recently. Last week, we posted a tech blog about CVE-2018-0171, a critical vulnerability in Cisco’s Smart Install feature that called for immediate mitigation as proof-of-concept code was released publicly. Now, a wave of attacks has moved through data centers across the internet targeting Cisco switches with Smart Install in various countries across the globe. This time around, attackers are (mis)using the Smart Install protocol with mal intent on Cisco’s switches that are open with Smart Install support. Once the attacker gains access, they rewrite the Cisco IOS image on the switches and change the configuration file. One such attack leaves a message that reads “Do not mess with our elections” as the message banner. The switch then becomes unavailable. 

Impact assessment

According to Cisco Talos, more than 168,000 devices found on Shodan have this vulnerability. The rate at which Cisco switches are being taken down isn’t known at this time. But, the loss of a switch can have a small to enormous impact on a data center, depending on the network architecture. Cisco switches utilized for internet connectivity may cause lost connectivity if they’re taken down. Any business that hasn’t mitigated their switches could experience a loss in connectivity affecting sales, productivity or customer interaction.

Exploitation

According to Cisco, “The Cisco Smart Install protocol can be abused to modify the Trivial File Transfer Protocol (TFTP) server setting, exfiltrate configuration files via TFTP, modify the configuration file, replace the IOS image, and set up accounts, allowing for the execution of IOS commands. Although this is not a vulnerability in the classic sense, the misuse of this protocol is an attack vector that should be mitigated immediately.”

Cisco released an advisory on the security of Smart Install last year and reiterated their advice last week.

Urgently required actions

Cisco and Tenable suggest immediate mitigation of Cisco switches by:

• Limiting access through an Access Control List
• Limiting access to TCP 4786 port
• Disabling the Smart Install Client on the switch

Identifying affected systems

• Cisco has released an open-source tool that scans for devices which use the Cisco Smart Install protocol
• Tenable uses plugin 105161 for Cisco Smart Install detection

Get more information

• Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
• Get a free 60-day trial of Tenable.io Vulnerability Management