Cisco Smart Install - How to Prevent Attacks on Switches
There’s been a flurry of activity around the Cisco Smart Install feature recently. Last week, we posted a tech blog about CVE-2018-0171, a critical vulnerability in Cisco’s Smart Install feature that called for immediate mitigation as proof-of-concept code was released publicly. Now, a wave of attacks has moved through data centers across the internet targeting Cisco switches with Smart Install in various countries across the globe. This time around, attackers are (mis)using the Smart Install protocol with mal intent on Cisco’s switches that are open with Smart Install support. Once the attacker gains access, they rewrite the Cisco IOS image on the switches and change the configuration file. One such attack leaves a message that reads “Do not mess with our elections” as the message banner. The switch then becomes unavailable.
Impact assessment
According to Cisco Talos, more than 168,000 devices found on Shodan have this vulnerability. The rate at which Cisco switches are being taken down isn’t known at this time. But, the loss of a switch can have a small to enormous impact on a data center, depending on the network architecture. Cisco switches utilized for internet connectivity may cause lost connectivity if they’re taken down. Any business that hasn’t mitigated their switches could experience a loss in connectivity affecting sales, productivity or customer interaction.
Exploitation
According to Cisco, “The Cisco Smart Install protocol can be abused to modify the Trivial File Transfer Protocol (TFTP) server setting, exfiltrate configuration files via TFTP, modify the configuration file, replace the IOS image, and set up accounts, allowing for the execution of IOS commands. Although this is not a vulnerability in the classic sense, the misuse of this protocol is an attack vector that should be mitigated immediately.”
Cisco released an advisory on the security of Smart Install last year and reiterated their advice last week.
Urgently required actions
Cisco and Tenable suggest immediate mitigation of Cisco switches by:
- Limiting access through an Access Control List
- Limiting access to TCP 4786 port
- Disabling the Smart Install Client on the switch
Identifying affected systems
- Cisco has released an open-source tool that scans for devices which use the Cisco Smart Install protocol
- Tenable uses plugin 105161 for Cisco Smart Install detection
Get more information
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
관련 기사
Foreshadow: Speculative Execution Attack Targets Intel SGX
August 14, 2018A flaw in Intel’s Software Guard Extensions implementation allows an attacker to access data stored in memory of other applications running on the same host, without the need for privilege escalation....
Advisory: Red Hat DHCP Client Command Injection Trouble
May 17, 2018On May 15, Red Hat disclosed a critical vulnerability in a script included in NetworkManager for the Dynamic Host Configuration Protocol (DHCP) client on Red Hat Enterprise Linux (RHEL). The vulnerabi...
Advisory: Intel...Simply Misunderstood?
May 11, 2018To close numerous security gaps, Microsoft, Adobe, Apple, Red Hat, Xen, VMware and other vendors have released a number of patches in the first 10 days of May. We discussed some of these in our recent...
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
- Plugins