This is better than the results of 2016 when one of Tenable’s employees reported 251,000 vulnerable Cisco Smart Install Client clients “visible” from the Internet. Using Shodan, Talos was able to determine that more than 168,000 systems could potentially be detected via the Cisco Internet Install Client. ScopeĪs part of the Cisco Talos study, we began to study how many devices are potentially vulnerable to this attack. To address the problem of protocol misuse, clients must also address this vulnerability by installing the appropriate update. This vulnerability was discussed publicly, and a code was issued with evidence of the possibility of intervention (PoC).

Recent information has raised the urgency of this problem and we decided to return to it again.ĭespite the fact that Cisco Smart Install, has recently been disclosed and fixed another vulnerability in the Cisco Smart Install Client. During late 2017 and early 2018, Talos watched as criminals tried to scan customers using this vulnerability.

Although this is not a vulnerability in the classical sense, the misuse of this protocol can serve as an attack vector, which should be immediately neutralized. The Cisco Smart Install protocol can be used to change TFTP server settings, export TFTP files, change configuration files, replace the IOS network image and configure accounts that enable IOS commands. In addition to the above signature for the system, Snort attacks ( SID: 41722-41725), allowing to detect any attempts to use this technology. In the sequel, Cisco Talos published a note in the blog and release of the open source tool that scans devices using the Cisco Smart Install protocol. The Cisco Smart Install Client software is an obsolete utility designed to remotely configure new Cisco equipment, in particular, Cisco switches.

On Febru(yes, there are no errors, it’s about 2017), the Cisco Security Incident Response Team (PSIRT) published a bulletin describing the results of the active scan associated with Cisco Smart Install clients.

As a result, we take an active position and call on customers, again, to assess risks and apply methods for neutralizing risks. Some experts believe that a number of attacks are associated with hackers who are in the service of the state.

Several incidents in different countries, including some related to critical infrastructure, have been associated with improper use of the Smart Install protocol.

Cisco recently learned of some of the hacker groups that Cisco switches chose to target, using the problem of misuse of the protocol in the Cisco Smart Install Client.

No vstack command cisco