CVE-2018-0171 # CISCO devices RCE flaw remains active in the wild

Despite being disclosed seven years ago, the Smart Install Remote Code Execution (RCE) flaw remains active in the wild, with over 1,200 Cisco devices still exposing the vulnerable service to the internet.
mart Install is a Cisco feature designed to automate initial configurations for new network devices, allowing them to “plug and play” into infrastructure without direct administrator intervention.
While convenient, the feature is enabled by default, requires no authentication, and often remains publicly accessible on port 4786.
CVE-2018-0171 specifically allows attackers to send malformed Smart Install packets that bypass validation and execute arbitrary commands—without needing credentials.
With cracked credentials in hand, a threat actor could:
Log in via SSH (if exposed)Use legitimate access to stay under the radarAvoid detection by not creating new accountsWhile CVE-2018-0171 is not new, its continued exploitation stems from poor patching and insecure defaults. Bruneau’s research highlights essential steps for network defenders:
Disable Smart Install (no vstack)Update Cisco IOS firmware via Cisco’s Software CheckerUse ACLs to restrict access to port 4786Avoid Type 7 passwords — use more secure hashingMonitor configuration changes and TFTP traffic