Proof of Concept (and Patch) for Critical Cisco IOS Vulnerability: CVE-2018-0171
Embedi, a security firm, has discovered a major security flaw in the Cisco Smart Install code. According to Embedi and Cisco, “A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.”
Smart Install is Cisco’s quick configuration method for their switches. Cisco states that in a Smart Install network, you can use the Zero-Touch Installation process to install new access layer switches to the network without assistance from the network administrator. In other words, you can ship a switch to a location, place it in the network and power it on without configuring the switch.
Impact assessment
A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could then: trigger a reload of the device, allow the attacker to execute arbitrary code on the device or cause an indefinite loop on the affected device that triggers a watchdog crash.
In a properly configured network environment, Smart Install technology participants should not be accessible through the internet. However, Embedi conducted a scan and detected “250,000 vulnerable devices and 8.5 million devices that have a vulnerable port open” to the internet. Compromised switches will lead to further degraded network security and reliability – and increased cyber risk.
Exploitation
A remote, unauthenticated attacker can exploit a flaw in the client to reload an affected device and cause denial of service or execute arbitrary code. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786.
Urgently required actions
Embedi has published proof-of-concept exploit code, and network administrators should immediately patch all Cisco devices.
Cisco has released a patch for this critical bug CVE-2018-0171 affecting Smart Install.
As more analysis is done across networks containing the vulnerability, Tenable suggests immediate patching. If a system is exploited, any system reboot will cause network outages.
Cisco devices configured as a Smart Install director are not affected by this vulnerability. Tenable suggests checking with Cisco for more information about specific Cisco devices.
Identifying affected systems
Tenable released the following plugins to identify affected systems.
- Nessus Plugin 108722 Cisco IOS Software Smart Install Remote Code Execution Vulnerability
- Nessus Plugin 108723 Cisco IOS XE Software Smart Install Remote Code Execution Vulnerability
Get more information
- Cisco Security Advisory
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Articoli correlati
Do You Think You Have No AI Exposures? Think Again
August 6, 2024As AI usage becomes more prevalent in organizations globally, security teams must get full visibility into these applications. Building a comprehensive inventory of AI applications in your environment is a first step. Read on to learn what we found about AI application-usage in the real world when we analyzed anonymized telemetry data from scans using Tenable’s products.
Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach
August 6, 2024As AI transforms industries, security remains critical. Discover the importance of a security-first approach in AI development, the risks of open-source tools, and how Tenable's solutions can help protect your systems.
Securing Financial Data in the Cloud: How Tenable Can Help
November 4, 2024Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
- Plugins