Cisco Smart Install - How to Prevent Attacks on Switches
There’s been a flurry of activity around the Cisco Smart Install feature recently. Last week, we posted a tech blog about CVE-2018-0171, a critical vulnerability in Cisco’s Smart Install feature that called for immediate mitigation as proof-of-concept code was released publicly. Now, a wave of attacks has moved through data centers across the internet targeting Cisco switches with Smart Install in various countries across the globe. This time around, attackers are (mis)using the Smart Install protocol with mal intent on Cisco’s switches that are open with Smart Install support. Once the attacker gains access, they rewrite the Cisco IOS image on the switches and change the configuration file. One such attack leaves a message that reads “Do not mess with our elections” as the message banner. The switch then becomes unavailable.
Impact assessment
According to Cisco Talos, more than 168,000 devices found on Shodan have this vulnerability. The rate at which Cisco switches are being taken down isn’t known at this time. But, the loss of a switch can have a small to enormous impact on a data center, depending on the network architecture. Cisco switches utilized for internet connectivity may cause lost connectivity if they’re taken down. Any business that hasn’t mitigated their switches could experience a loss in connectivity affecting sales, productivity or customer interaction.
Exploitation
According to Cisco, “The Cisco Smart Install protocol can be abused to modify the Trivial File Transfer Protocol (TFTP) server setting, exfiltrate configuration files via TFTP, modify the configuration file, replace the IOS image, and set up accounts, allowing for the execution of IOS commands. Although this is not a vulnerability in the classic sense, the misuse of this protocol is an attack vector that should be mitigated immediately.”
Cisco released an advisory on the security of Smart Install last year and reiterated their advice last week.
Urgently required actions
Cisco and Tenable suggest immediate mitigation of Cisco switches by:
- Limiting access through an Access Control List
- Limiting access to TCP 4786 port
- Disabling the Smart Install Client on the switch
Identification des systèmes affectés
- Cisco has released an open-source tool that scans for devices which use the Cisco Smart Install protocol
- Tenable uses plugin 105161 for Cisco Smart Install detection
Où trouver plus d'informations
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Articles connexes
Cybersecurity Snapshot: CISA Tells Tech Vendors To Squash Command Injection Bugs, as OpenSSF Calls on Developers To Boost Security Skills
July 12, 2024Check out CISA’s call for weeding out preventable OS command injection vulnerabilities. Plus, the Linux Foundation and OpenSSF spotlight the lack of cybersecurity expertise among SW developers. Meanwhile, GenAI deployments have tech leaders worried about data privacy and data security. And get the latest on FedRAMP, APT40 and AI-powered misinformation!
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Microsoft’s July 2024 Patch Tuesday Addresses 138 CVEs (CVE-2024-38080, CVE-2024-38112)
July 9, 2024Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.
- Plugins