Embedi, a security firm, has discovered a major security flaw in the Cisco Smart Install code. According to Embedi and Cisco, “A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.”
Smart Install is Cisco’s quick configuration method for their switches. Cisco states that in a Smart Install network, you can use the Zero-Touch Installation process to install new access layer switches to the network without assistance from the network administrator. In other words, you can ship a switch to a location, place it in the network and power it on without configuring the switch.
A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could then: trigger a reload of the device, allow the attacker to execute arbitrary code on the device or cause an indefinite loop on the affected device that triggers a watchdog crash.
In a properly configured network environment, Smart Install technology participants should not be accessible through the internet. However, Embedi conducted a scan and detected “250,000 vulnerable devices and 8.5 million devices that have a vulnerable port open” to the internet. Compromised switches will lead to further degraded network security and reliability – and increased cyber risk.
A remote, unauthenticated attacker can exploit a flaw in the client to reload an affected device and cause denial of service or execute arbitrary code. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786.
Urgently required actions
Embedi has published proof-of-concept exploit code, and network administrators should immediately patch all Cisco devices.
Cisco has released a patch for this critical bug CVE-2018-0171 affecting Smart Install.
As more analysis is done across networks containing the vulnerability, Tenable suggests immediate patching. If a system is exploited, any system reboot will cause network outages.
Cisco devices configured as a Smart Install director are not affected by this vulnerability. Tenable suggests checking with Cisco for more information about specific Cisco devices.
Identifying affected systems
Tenable released the following plugins to identify affected systems.
- Nessus Plugin 108722 Cisco IOS Software Smart Install Remote Code Execution Vulnerability
- Nessus Plugin 108723 Cisco IOS XE Software Smart Install Remote Code Execution Vulnerability
Get more information
- Cisco Security Advisory
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management