April 20, 2014

Cisco IOS Smart Install Remote Code Execution Vulnerability

(LiveHacking.Com) – Cisco has released a security advisory to address a vulnerability in the Smart Install feature of Cisco Catalyst Switches running Cisco IOS Software that could allow an unauthenticated, remote attacker to perform remote code execution on the affected device. Smart Install uses TCP port 4786 for communication. An established TCP connection with a completed TCP three-way handshake is needed to be able to trigger this vulnerability.

There are no workarounds available to mitigate this vulnerability other than disabling the Smart Install feature. But Cisco has released free software updates that address this vulnerability.