CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Smart Install is a zero-touch provisioning feature: a new switch (the client) listens on TCP 4786 for a director that tells it which IOS image and configuration to load. The client did not validate message data properly, so a crafted Smart Install message overflows a buffer. Cisco lists three outcomes: a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution.

The attacker needs only network reach to port 4786. Public exploit code has existed since 2018, and EPSS rates exploitation probability near the top of all CVEs.

The real-world use is espionage at scale. Cisco Talos tracks a Russian FSB Center 16 group it calls Static Tundra, linked to Energetic Bear, that has exploited this flaw since at least 2021. After access, the group starts a TFTP server on the switch and pulls the startup configuration. Those files hold SNMP community strings, local account hashes and network layout, which the group reuses to reconfigure devices, add accounts, enable Telnet, build GRE tunnels to mirror traffic and collect NetFlow. Talos also links the group with moderate confidence to SYNful Knock, a firmware implant that survives reboots. Targets include telecommunications, higher education and manufacturing, with a focus on Ukraine and its allies. Even without the overflow, the Smart Install protocol itself can be misused to change the startup config or load a new image, which is what NSA's original advisory warned about.

Only switches acting as Smart Install clients running a vulnerable IOS or IOS XE release are affected; directors are not. The client is enabled by default on releases that lack the fix for CSCvd36820, and many affected switches are past end of life.

Check on each switch:

show vstack config
show tcp brief all | include 4786
show version

Role: Client (SmartInstall enabled), or Oper Mode: Enabled with Role: Client, means the feature is on. A listener on *:4786 means the port is open. Use Cisco's IOS Software Checker with the show version output to find the first fixed release. These commands show exposure, not compromise.

Upgrade to a fixed IOS or IOS XE release found with the Cisco Software Checker; Cisco gives no workaround for customers who need Smart Install. If you do not use it, which NSA and partner agencies say applies to most production networks, disable it:

conf t
 no vstack
end
write memory

Then block TCP 4786 and TFTP (UDP 69) at the network edge, review every switch configuration against a known-good copy, and replace end-of-life switches that cannot run a fixed release.

CISA lists this CVE in its Known Exploited Vulnerabilities catalog with the required action "Apply updates per vendor instructions," due May 3, 2022 for US federal agencies.

Look for inbound connections to TCP 4786 from the internet, TFTP traffic leaving switches, and startup-config copies you did not schedule. On the device, compare the running and startup configuration with a centrally stored baseline: unexpected local accounts, new read-write SNMP community strings, Telnet enabled on VTY lines, changed ACLs or TACACS+ settings, and new GRE tunnels are the signs Talos lists. Gaps in syslog or AAA logs matter too. Talos published IP indicators for Static Tundra and a scanner for the SYNful Knock implant. If you find signs, treat every credential and SNMP string in that configuration as exposed and rotate them.

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.