Action Required to Secure the Cisco IOS and IOS XE Smart Install Feature

Smart Install Vulnerability History

The following table lists the Advisories that identify the Smart Install feature (Client and/or Director) as being vulnerable and the extent that these respective vulnerabilities are being actively exploited:

Summary of Recommended Actions

To ensure their network is protected against issues involving Smart Install, our recommendation for customers not actually using Smart Install is to disable the feature using the no vstack command once setup is complete. Customers who do use the feature - and need to leave it enabled - can use ACLs to block incoming traffic on TCP port 4786 (the proper security control). Additionally, patches for known security vulnerabilities should be applied as part of standard network security management.

Identification & Mitigation Steps

Customers concerned with potential exposure of their network devices to the Smart Install vulnerabilities should adhere to the following process:

1. Software Affected?- Determine if the software version(s) in use are affected by the vulnerabilities described within the Smart Install Security Advisories.
2. Feature Enabled? - For devices running affected software versions, these devices should be checked for the presence of the Smart Install Client feature.
3. Mitigate Exposure by:
   1. Disabling Feature - On devices found to be running the Smart Install Client feature, customers should disable the feature or, where not applicable,
   2. Restrict Smart Install Access - Minimize the exposure of the feature by implementing ACLs and Control Plane Policing (CoPP).

Smart Install Deployment Risk

Cisco Smart Install is a legacy feature that provides zero-touch deployment for new switches, typically access layer switches, and incorporates no authentication by design. Newer technology, such as the Cisco Network Plug and Play feature, is highly recommended for more secure setup of new switches. If not properly disabled or secured following setup, Smart Install could allow for the exfiltration and modification of configuration files, among other things, even without the presence of a vulnerability.

A Smart Install network consists of one Smart Install Director switch or router, also known as the Integrated Branch Director (IBD), and one or more Smart Install Client switches, also known as Integrated Branch Clients (IBCs).

The Smart Install feature is enabled by default on client switches. No specific configuration is needed on Smart Install Client switches, whereas the Smart Install Director must be configured explicitly.

Confirmation of Affected Versions of IOS and IOS XE

Cisco IOS and IOS XE Software

To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker, that identifies any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified (“Combined First Fixed”).

Customers can use this tool to perform the following tasks:

• Initiate a search by choosing one or more releases from a drop-down list or uploading a file from a local system for the tool to parse
• Enter the output of the show version command for the tool to parse
• Create a custom search by including all previously published Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication

To determine whether a release is affected by any published Cisco Security Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco IOS Software or Cisco IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S-in the following field:

Identification of Vulnerable Devices

Verification of Device with Smart Install Client Enabled

The following example shows the output of the show vstack config command in a Cisco Catalyst switch with the Smart Install Client feature enabled. These are the only outputs that indicates that the Smart Install Client feature is enabled:

Switch4#show vstack config | include Role
Role: Client (SmartInstall enabled)

switch4# show vstack config
Capability: Client
Oper Mode: Enabled
Role: Client

Verification of Device Listening on TCP Port 4786

The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786):

Switch#show tcp brief all | include 4786
FFB6D31818  0.0.0.0.4786               *.*                         LISTEN
Switch#

The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786) AND has a connection to a Smart Install Director (IP address: 10.69.12.117):

FFA893EA50  10.66.91.126.4786          10.69.12.117.54246          CLOSEWAIT
FFB6D31818  0.0.0.0.4786               *.*                         LISTEN
Switch#

Please note that this method cannot distinguish between a device running as a Smart Install Client and a device running as a Smart Install Director. As such, the show vstack config command is preferred whenever possible.

Disabling Smart Install

Issue "no vstack" Command

Upon successful deployment of Cisco Switches, administrators should either utilize Smart Install or immediately disable the Smart Install Client feature if Smart Install is not used, as the feature will no longer be required for operation. The Smart Install feature can be disabled with the no vstack command.

Restrict Smart Install Access

"no vstack" Command Not Available or Smart Install Used for More Than Zero-Touch Deployment

For networks where the no vstack command is not available or where Smart Install is used for more than just zero-touch deployment, customers should ensure that only the IBD has TCP connectivity to all IBCs on port 4786. Administrators can use the following security best practices for Cisco Smart Install deployments on affected devices:

• Interface access control lists (ACLs)
• Control Plane Policing (CoPP)

An interface ACL might look like the following example, with the IP address of the Smart Install Director (IBD) being 10.10.10.1 and the IP address of the Smart Install Client (IBC) being 10.10.10.200:

    ip access-list extended SMI_HARDENING_LIST
      permit tcp host 10.10.10.1 host 10.10.10.200 eq 4786
      deny tcp any any eq 4786
      permit ip any any

Additional Support

References

Security Advisories

Cisco IOS Software Smart Install Remote Code Execution Vulnerability

Cisco IOS Software Smart Install Denial of Service Vulnerability

Cisco IOS Software Smart Install Denial of Service Vulnerability

Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability

Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability

Cisco Smart Install Protocol Misuse (First Published 14-Feb-2017)

Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability (First Published 28-Mar-2018)

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (First Published 28-Mar-2018)

Blog Posts

Cisco Blog Post, “Cisco PSIRT - Mitigating and Detecting Potential Abuse of Cisco Smart Install Feature” (published 27-Feb-2017)

Cisco Talos Blog Post, “Cisco Coverage for Smart Install Client Protocol Abuse” (published 27-Feb-2017)

Cisco Talos Blog Post, “Critical Infrastructure at Risk: Advanced Actors Target Smart Install Client” (published 5-Apr-2018)

Tools & Additional References

Cisco IOS Software Checker

TALOS Smart Install Detection Tool

Smart Install Configuration Guide

Appendix-Smart Install Feature Caveats

Auto-Disable Smart Install

In software releases that incorporate the changes from Cisco Bug ID CSCvd36820, Cisco Smart Install Client feature should auto-disable after boot as soon as the switch detects that zero-touch deployment is not being used.

Support of “no vstack” Command

“no vstack” Command Does Not Persist Across Reload

• Cisco Catalyst 4500 and 4500-X Series Switches: 3.9.2E/15.2(5)E2
• Cisco Catalyst 6500 Series Switches: 15.1(2)SY11, 15.2(1)SY5, 15.2(2)SY3
• Cisco Industrial Ethernet 4000 Series Switches: 15.2(5)E2, 15.2(5)E2a
• Cisco ME 3400 and ME 3400E Series Ethernet Access Switches: 12.2(60)EZ11

Existing Smart Install (SMI) Processes

Additional Smart Install Information

• The Cisco Smart Install client must send alerts to the local console periodically. This was added to provide awareness to customers that the feature is enabled. This was done via CSCvd36810.
• Make show vstack config nomenclature consistent. Prior to this fix, the output for the role information was slightly different and caused some confusion. Fixes were done via CSCvd35782.
• Make Smart Install Configuration visible in the configuration. By default, SMI never used to show vstack in show running or show running all config. Cisco added this so that if it is enabled, vstack will be present in the running configuration. This was done via CSCvd36799.
• The Smart Install feature was removed in more recent releases, in particular from 16.4.2, 16.5.1b, 16.6.2, 16.7.1, and later. This was done via CSCvf04861 and CSCvg90005.