Cisco Smart Install Stack Overflow RCE
- Product
- Cisco IOS / IOS XE Smart Install
- CVE
- CVE-2018-0171
- Disclosed
- 2018-03-28
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Cisco IOS and IOS XE switches with the Smart Install client feature enabled (TCP 4786).
- Fixed
- Fixed IOS / IOS XE releases per cisco-sa-20180328-smi2; or disable Smart Install.
Summary
A stack overflow in the Smart Install client allowed unauthenticated attackers on TCP 4786 to reload devices or run code. It has been exploited for years, including by Russian state actors (Static Tundra) against critical infrastructure.
Root cause
The Smart Install client did not validate the length of fields in crafted Smart Install messages, overflowing a stack buffer. Separately, the protocol's lack of authentication lets attackers pull or replace device configuration even without memory corruption.
Impact
Unauthenticated code execution, device reloads, and configuration theft or modification.
Detection
Scan for open TCP 4786 and run 'show vstack config'; Cisco's Smart Install Scanner and Talos guidance help identify exposure.
Mitigation
Upgrade and disable Smart Install with 'no vstack'.