April 12, 2018
Cisco Smart Install RCE Vulnerability – WST
Cisco Smart Install RCE Vulnerability
Cisco’s Smart Install, while providing IT staffs with a relatively painless way to deploy new network equipment, has seen a recent uptick in attacks. Vulnerabilities for this service go back to 2011, and all of them include at least a Denial of Service (DoS) component that will at best reboot the device, and at worst, crash it. Along with the DoS potential, the newest vulnerability contains the potential for remote code execution. This would allow an attacker to execute arbitrary code on the targeted network device.
What can be done? Cisco appears to have released updates that patch the latest vulnerability (CVE-2018-0171 which should be installed as soon as an update window can be arranged. Also, among Cisco’s best practices is the suggestion to only open port 4786 to specific devices. If you are not using Cisco’s Smart Install, the no vstack command should disable the Smart Install, though your mileage may vary.