On April 17th, 2018, Cisco issued a critical SMI vulnerability security advisory relating to the previously issued SMI protocol misuse informational advisory[1]. The newly identified vulnerability can be exploited by a remote unauthenticated attacker by sending crafted SMI packets to an affected device on TCP port 4786, allowing them to execute arbitrary code on the device. Smart Install client functionality is enabled by default on switches which have not been updated to address Cisco BugID CSCvd36820[2].
The IT Security Office recommends that as soon as reasonably possible, users determine whether their switch is affected by this vulnerability by visiting, https://www.cisco.com/c/en/us/td/docs/switches/lan/smart_install/configuration/guide/smart_install/supported_devices.html, and patch affected devices. For more information about this vulnerability, visit https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
[1] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi
[2] https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd36820
© 2024 Regents of the University of California