Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Proof of Concept (and Patch) for Critical Cisco IOS Vulnerability: CVE-2018-0171

Embedi, a security firm, has discovered a major security flaw in the Cisco Smart Install code. According to Embedi and Cisco, “A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.”

Smart Install is Cisco’s quick configuration method for their switches. Cisco states that in a Smart Install network, you can use the Zero-Touch Installation process to install new access layer switches to the network without assistance from the network administrator. In other words, you can ship a switch to a location, place it in the network and power it on without configuring the switch.

Impact assessment

A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could then: trigger a reload of the device, allow the attacker to execute arbitrary code on the device or cause an indefinite loop on the affected device that triggers a watchdog crash.

In a properly configured network environment, Smart Install technology participants should not be accessible through the internet. However, Embedi conducted a scan and detected “250,000 vulnerable devices and 8.5 million devices that have a vulnerable port open” to the internet. Compromised switches will lead to further degraded network security and reliability – and increased cyber risk.

Exploitation

A remote, unauthenticated attacker can exploit a flaw in the client to reload an affected device and cause denial of service or execute arbitrary code. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786.

Urgently required actions

Embedi has published proof-of-concept exploit code, and network administrators should immediately patch all Cisco devices.

Cisco has released a patch for this critical bug CVE-2018-0171 affecting Smart Install.

As more analysis is done across networks containing the vulnerability, Tenable suggests immediate patching. If a system is exploited, any system reboot will cause network outages.

Cisco devices configured as a Smart Install director are not affected by this vulnerability. Tenable suggests checking with Cisco for more information about specific Cisco devices.

Identifying affected systems

Tenable released the following plugins to identify affected systems.

  • Nessus Plugin 108722 Cisco IOS Software Smart Install Remote Code Execution Vulnerability
  • Nessus Plugin 108723 Cisco IOS XE Software Smart Install Remote Code Execution Vulnerability

Get more information

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io Vulnerability Management

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.