Smart Install Vulnerability History
The following table lists the Advisories that identify the Smart Install feature (Client and/or Director) as being vulnerable and the extent that these respective vulnerabilities are being actively exploited:
Summary of Recommended Actions
To ensure their network is protected against issues involving Smart Install, our recommendation for customers not actually using Smart Install is to disable the feature using the no vstack command once setup is complete. Customers who do use the feature – and need to leave it enabled – can use ACLs to block incoming traffic on TCP port 4786 (the proper security control). Additionally, patches for known security vulnerabilities should be applied as part of standard network security management.
Identification & Mitigation Steps
Customers concerned with potential exposure of their network devices to the Smart Install vulnerabilities should adhere to the following process:
- Software Affected?- Determine if the software version(s) in use are affected by the vulnerabilities described within the Smart Install Security Advisories.
- Feature Enabled? - For devices running affected software versions, these devices should be checked for the presence of the Smart Install Client feature.
- Mitigate Exposure by:
- Disabling Feature - On devices found to be running the Smart Install Client feature, customers should disable the feature or, where not applicable,
- Restrict Smart Install Access - Minimize the exposure of the feature by implementing ACLs and Control Plane Policing (CoPP).
Smart Install Deployment Risk
Cisco Smart Install is a legacy feature that provides zero-touch deployment for new switches, typically access layer switches, and incorporates no authentication by design. Newer technology, such as the Cisco Network Plug and Play feature, is highly recommended for more secure setup of new switches. If not properly disabled or secured following setup, Smart Install could allow for the exfiltration and modification of configuration files, among other things, even without the presence of a vulnerability.
A Smart Install network consists of one Smart Install Director switch or router, also known as the Integrated Branch Director (IBD), and one or more Smart Install Client switches, also known as Integrated Branch Clients (IBCs).
The Smart Install feature is enabled by default on client switches. No specific configuration is needed on Smart Install Client switches, whereas the Smart Install Director must be configured explicitly.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker, that identifies any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified (“Combined First Fixed”).
Customers can use this tool to perform the following tasks:
- Initiate a search by choosing one or more releases from a drop-down list or uploading a file from a local system for the tool to parse
- Enter the output of the show version command for the tool to parse
- Create a custom search by including all previously published Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication
To determine whether a release is affected by any published Cisco Security Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco IOS Software or Cisco IOS XE Software release—for example, 15.1(4)M2 or 3.13.8S—in the following field:
Verification of Device with Smart Install Client Enabled
The following example shows the output of the show vstack config command in a Cisco Catalyst switch with the Smart Install Client feature enabled. These are the only outputs that indicates that the Smart Install Client feature is enabled:
Switch1#show vstack config | include Role
Role: Client (SmartInstall enabled)
switch2# show vstack config
Oper Mode: Enabled
Verification of Device Listening on TCP Port 4786
The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786):
Switch#show tcp brief all | include 4786
FFB6D31818 0.0.0.0.4786 *.* LISTEN
The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786) AND has a connection to a Smart Install Director (IP address: 10.69.12.117):
FFA893EA50 10.66.91.126.4786 10.69.12.117.54246 CLOSEWAIT
FFB6D31818 0.0.0.0.4786 *.* LISTEN
Please note that this method cannot distinguish between a device running as a Smart Install Client and a device running as a Smart Install Director. As such, the show vstack config command is preferred whenever possible.
Issue "no vstack" Command
Upon successful deployment of Cisco Switches, administrators should either utilize Smart Install or immediately disable the Smart Install Client feature if Smart Install is not used, as the feature will no longer be required for operation. The Smart Install feature can be disabled with the no vstack command.
"no vstack" Command Not Available or Smart Install Used for More Than Zero-Touch Deployment
For networks where the no vstack command is not available or where Smart Install is used for more than just zero-touch deployment, customers should ensure that only the IBD has TCP connectivity to all IBCs on port 4786. Administrators can use the following security best practices for Cisco Smart Install deployments on affected devices:
- Interface access control lists (ACLs)
- Control Plane Policing (CoPP)
An interface ACL might look like the following example, with the IP address of the Smart Install Director (IBD) being 10.10.10.1 and the IP address of the Smart Install Client (IBC) being 10.10.10.200:
This ACL would then need to be deployed on all IP interfaces on all IBCs. It can be pushed via the IBD when the switches are first deployed.
ip access-list extended SMI_HARDENING_LIST
permit tcp host 10.10.10.1 host 10.10.10.200 eq 4786
deny tcp any any eq 4786
permit ip any any
Customers who require support to determine if the feature is still enabled or suspect their devices are being potentially exploited should contact their support team (Advanced Services, TAC, etc.) and provide additional details as requested by Cisco.
Cisco IOS Software Smart Install Remote Code Execution Vulnerability
Cisco IOS Software Smart Install Denial of Service Vulnerability
Cisco IOS Software Smart Install Denial of Service Vulnerability
Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability
Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability
Cisco Smart Install Protocol Misuse (First Published 14-Feb-2017)
Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability (First Published 28-Mar-2018)
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (First Published 28-Mar-2018)
Cisco Blog Post, “Cisco PSIRT – Mitigating and Detecting Potential Abuse of Cisco Smart Install Feature” (published 27-Feb-2017)
Cisco Talos Blog Post, “Cisco Coverage for Smart Install Client Protocol Abuse” (published 27-Feb-2017)
Cisco Talos Blog Post, “Critical Infrastructure at Risk: Advanced Actors Target Smart Install Client” (published 5-Apr-2018)
Tools & Additional References
Cisco IOS Software Checker
TALOS Smart Install Detection Tool
Smart Install Configuration Guide
Appendix—Smart Install Feature Caveats
Auto-Disable Smart Install
In software releases that incorporate the changes from Cisco Bug ID CSCvd36820, Cisco Smart Install Client feature should auto-disable after boot as soon as the switch detects that zero-touch deployment is not being used.
Support of “no vstack” Command
Use of the no vstack global configuration command to disable the Smart Install Client feature was introduced with the fix for Cisco defect CSCtj75729 (Ability to shut Smart Install default service on TCP port 4786). If a Cisco IOS or IOS XE Software release supports the Smart Install Client feature but the no vstack command does not exist, the release does not contain the fix for Cisco defect CSCtj75729.
“no vstack” Command Does Not Persist Across Reload
Note: The no vstack command does not persist across reload due to Cisco defect CSCvd99197 in the following releases of Cisco IOS and IOS XE Software:
For customers running any of these releases, Cisco recommends upgrading or downgrading to a nonaffected release or putting automation in place to reconfigure the no vstack command after every reload of the device.
- Cisco Catalyst 4500 and 4500-X Series Switches: 3.9.2E/15.2(5)E2
- Cisco Catalyst 6500 Series Switches: 15.1(2)SY11, 15.2(1)SY5, 15.2(2)SY3
- Cisco Industrial Ethernet 4000 Series Switches: 15.2(5)E2, 15.2(5)E2a
- Cisco ME 3400 and ME 3400E Series Ethernet Access Switches: 12.2(60)EZ11
Existing Smart Install (SMI) Processes
The no vstack command does not kill any running SMI processes, but it will prevent any new requests. When no vstack is entered, while previously the client had received an SMI request to perform an action, that process will continue running until completion or failure. Committing no vstack to memory and reloading should remove these messages. This is addressed as part of the fix for CSCvd36820.
Additional Smart Install Information
- The Cisco Smart Install client must send alerts to the local console periodically.
This was added to provide awareness to customers that the feature is enabled. This was done via CSCvd36810.
- Make show vstack config nomenclature consistent.
Prior to this fix, the output for the role information was slightly different and caused some confusion. Fixes were done via CSCvd35782.
- Make Smart Install Configuration visible in the configuration.
By default, SMI never used to show vstack in show running or show running all config. Cisco added this so that if it is enabled, vstack will be present in the running configuration. This was done via CSCvd36799.
- The Smart Install feature was removed in more recent releases, in particular from 16.4.2, 16.5.1b, 16.6.2, 16.7.1, and later. This was done via CSCvf04861 and CSCvg90005.