New Cisco Vulnerability Discovered

xervantes (60)in #technology • 7 years ago (edited)

A new vulnerability has been discovered on Cisco devices. It is possible to access Cisco Routers and Switches without any form of authentication.

Smart Install

Smart (SMI) install is a feature that is used on Cisco Networking devices. The Protocol can be used for the automated (zero-touch) remote configuration of Cisco Networking devices.
The feature is often used if staging the network devices on site is not an option and remote access is the only way to configure the device.

source

The downside

SMI doesn't use authentication or authorization protocols and because of this anyone with access to the protocol can gain access to the configuration of the networking device. This person will be able to to edit the configuration and rewrite it. Furthermore it is also possible to execute commands on the network device using the command line. This means that the entire network can be hacked. Unauthorized persons could disable, tap or take control of the network.

Why it matters

The Smart install feature is "on" by default. That means that when installing the network devices that you actually have to turn it off if you are not planning on using this feature. Chances are most people, even IT technicians are not aware that this protocol is enabled on their network.

The countermeasures

Cisco does not consider this a vulnerability but a feature included on their network devices. That's why they are not planning on releasing a fix. Their advice is to turn off the Smart install if you are not using the protocol.

To check if your network devices (primarily switches) are vulnerable, input the following command in the command line (IOS or IOS XE):
switch#show vstack config | inc Role
If the output is:
Role: Client (SmartInstall enabled)
Then your devices are vulnerable to the exploit.

To disable the Smart Install feature use the following configuration command:
no vstack

When you are making use of the Smart install feature and don't want to turn it off than it is advisable to split your network into sub-networks (network segmentation) this way the protocol will only be active in parts of your network. This will prevent hackers of taking over your entire network.