Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
TL;DR 📌
A critical vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software allows unauthenticated remote attackers to execute arbitrary code or trigger a denial of service on affected devices. Immediate action is required to mitigate risks.
What happened 🕵️♂️
Cisco has identified a vulnerability in the Smart Install feature of its IOS and IOS XE Software. This flaw allows an unauthenticated remote attacker to send crafted messages to devices, potentially leading to a buffer overflow. Successful exploitation can result in device reloads, arbitrary code execution, or an indefinite loop causing a watchdog crash. Cisco has observed ongoing exploitation attempts and strongly recommends upgrading to fixed software releases.
Affected products 🖥️
The vulnerability affects Cisco devices running vulnerable releases of Cisco IOS or IOS XE Software with the Smart Install client feature enabled. Devices configured as Smart Install directors are not affected. For specific device details, refer to the Smart Install Configuration Guide.
Fixed software 🔧
Upgrade to the first fixed release in your train (or later):
| Release / Product | First Fixed Release | Notes |
|---|---|---|
| 1.9 | Updated information about continued exploitation activity. | |
| 1.8 | Updated exploitation information. | |
| 1.7 | Updated metadata - Cisco Catalyst 6500 and 6800 Series Switches have been identified as not vulnerable, which resulted in fewer releases being vulnerable. Updated the IOS Software Checker accordingly. | |
| 1.6 | Updated IOS Software Checker with products found to be vulnerable. | |
| 1.5 | Updated IOS Software Checker with products found to be non-vulnerable. | |
| 1.4 | Emphasized that Smart Install is enabled by default. Added a link to the list of devices that support Smart Install. | |
| 1.3 | Added more details to the Workarounds section. | |
| 1.2 | Metadata update. | |
| 1.1 | Added the researcher’s company name. | |
| 1.0 | Initial public release. |
Workarounds 🧯
There are no workarounds that address this vulnerability for customers who require Cisco Smart Install. However, if Smart Install is not needed, it can be disabled using the no vstack command.
Risk in context 🎯
With a CVSS score of 9.8, this vulnerability is rated as Critical. The exposure is significant as it allows unauthenticated access, and the potential for denial of service or arbitrary code execution poses a serious risk to network integrity and availability.
Fast facts ⚡
- CVSS Score: 9.8 (Critical)
- Exploitation: Ongoing attempts observed
- Impact: Denial of service, arbitrary code execution
- Smart Install: Enabled by default on vulnerable devices
For leadership 🧭
Executive summary. Cisco switches and routers with Smart Install enabled can be crashed or fully compromised by an attacker with no credentials, and because the feature ships on by default many devices are exposed without anyone having turned it on deliberately. Given the critical severity and reported exploitation attempts, this needs attention this week, not at the next routine maintenance cycle.
Why it matters:
- Smart Install is enabled by default on supporting Cisco IOS and IOS XE devices, so exposure may exist even where nobody consciously configured the feature.
- No authentication is required to trigger the flaw; crafted Smart Install messages sent to the device can cause a buffer overflow leading to arbitrary code execution or a watchdog crash and reload.
- A successful attack against a core or distribution switch or router directly threatens network availability, not just a single host.
- There is no workaround for sites that need Smart Install; the only mitigation short of patching is disabling the feature entirely with ’no vstack'.
Now / Next / Later:
- Now: Identify all Cisco IOS and IOS XE devices with Smart Install client enabled and check their software release against the fixed-release table; if Smart Install is not in use, disable it immediately with ’no vstack'.
- Next: Schedule a change window to upgrade all vulnerable devices to the first fixed release for their train, prioritising anything reachable from untrusted or less-trusted network segments.
- Later: Make Smart Install disablement (or removal) part of standard device build and audit checklists so the feature is not left enabled by default on future deployments.