Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Update August 20, 2025: Cisco is aware of continued exploitation activity of the vulnerability that is described in this advisory and strongly recommends that customers assess their systems and upgrade to a fixed software release as soon as possible. A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software…
  • Highest CVSS: 9.8 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2018-0171.

What it is

CVE-2018-0171 is a remote code execution vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software. It carries a CVSS score of 9.8 (Critical).

Smart Install is a zero-touch provisioning feature that lets a director switch push images and configuration to client switches, which can sit up to seven hops away. By design, it incorporates no authentication. The flaw is due to improper validation of packet data: an attacker who can reach a Smart Install client switch on TCP port 4786 can send a crafted Smart Install message and trigger a buffer overflow. No credentials are required and the attack is entirely network-based.

A successful exploit can do one of three things: force a reload of the device (denial of service), execute arbitrary code on it, or push it into an indefinite loop that ends in a watchdog crash.

Only devices acting as Smart Install clients are affected — director devices are not. Smart Install client functionality is enabled by default on IOS releases that predate the fix for Cisco bug CSCvd36820. Cisco has confirmed IOS XR and NX-OS are not affected.

What to do

  • Identify which switches have Smart Install client enabled. Run show vstack config; an output of Role: Client with Oper Mode: Enabled (or Role: Client (SmartInstall enabled)) confirms exposure.
  • If you don’t use Smart Install, disable it on client devices with the no vstack command. This is the only mitigation Cisco lists; there is no workaround for environments that need to keep Smart Install running.
  • Where Smart Install must stay in use, upgrade to a fixed IOS or IOS XE release. The advisory does not list specific fixed versions in the material reviewed here — use the Cisco IOS Software Checker with your current show version output to get the first fixed release for your train.
  • Restrict access to TCP/4786 at the network layer (ACLs, segmentation) for any client switches that cannot be immediately patched or reconfigured.
  • Before upgrading, confirm the target device has sufficient memory and that the new release supports your current hardware and configuration, as Cisco advises in the fixed-software guidance.

For leadership 🧭

Executive summary. Any Cisco switch left with Smart Install client mode enabled and reachable on TCP/4786 can be crashed or fully taken over by anyone on the network path, without needing a password. Given continued exploitation attempts reported by Cisco, affected switches should be identified and either disabled or patched this week, not scheduled for a future maintenance cycle.

Why it matters:

  • Smart Install has no authentication by design, so any device that can reach TCP/4786 on a client switch can send a crafted packet and trigger the flaw — no credentials, no user interaction.
  • Impact ranges from a forced reload (denial of service) through an indefinite loop causing a watchdog crash, up to arbitrary code execution on the switch itself.
  • Client switches can sit up to seven hops from the Smart Install director, so exposure isn’t limited to devices directly facing untrusted networks — it can extend deep into the access layer.
  • Cisco has confirmed ongoing exploitation attempts against this vulnerability, and there is no workaround for sites that still need Smart Install running.

Now / Next / Later:

  • Now: Run show vstack config on Cisco IOS/IOS XE switches to find any showing Role: Client with Oper Mode: Enabled — these are exposed right now.
  • Next: For switches that don’t need Smart Install, disable it immediately with no vstack; for those that do, use the Cisco IOS Software Checker against your current show version output to identify and schedule the first fixed release for your train.
  • Later: Put TCP/4786 behind ACLs or network segmentation for any client switches that can’t be immediately patched, and confirm memory and hardware support before rolling upgrades, so Smart Install exposure is caught by policy rather than by a fresh port-4786 scan.

Source