Cisco Smart Install, Web UI and SNMP exposure
Seven years. Cisco fixed the Smart Install flaw in 2018. In August 2025, the FBI warned that Russian FSB actors were collecting configuration files for thousands of network devices, through Smart Install and SNMP.
The way in was not a new exploit. It was a service nobody uses, left listening.
The official record
Three management services. Smart Install, CVE-2018-0171, scored 9.8, with the client enabled by default on switches running releases without a later fix.
The IOS XE web interface, CVE-2023-20198, scored 10.0: an attacker could create an administrator account without logging in, and CISA listed it the same day Cisco published.
And SNMP, CVE-2017-6736, scored 8.8, which needs only the community string.
How easy is it?
For Smart Install and the web interface, the attacker only needs to reach the port. No account, low complexity.
For SNMP, the community string is the only key, and US agencies note that many compromised devices used the well known strings, public and private.
How it works, in principle
A switch or router keeps services running that nobody asked for: Smart Install on TCP port 4786, the web interface, SNMP. Each one is a door.
Through them, the configuration is copied or replaced, and in 2023, implants were written onto IOS XE devices.
The impact
The configuration leaves the device, with password hashes and SNMP community strings inside. Attackers create their own administrator accounts.
And state actors from more than one country have used these doors, according to US and allied advisories.
How to close it
If you do not use Smart Install, turn it off with no vstack, and check that it stays off after a reload. Turn off the web server, no ip http server and no ip http secure-server, at least on anything facing the Internet.
Put an access list on every SNMP community, and prefer SNMP version 3.
And upgrade: for IOS XE, 17.9.4a, 17.6.6a or 17.3.8a, or later.
What NacTrack shows
NacTrack flags Smart Install, the web server and SNMP version 1 and 2c communities in Cisco configurations, and matches IOS and IOS XE versions against Cisco's advisories.
Sources
Sources: CISA KEV, Cisco PSIRT advisories, NVD, FBI PSA I-082025, CISA AA25-239A and TA18-106A.
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.
Know where your network is exposed
NacTrack reads versions and configurations off your devices, and checks them against published advisories.