NSA: Disable Cisco Smart Install Now. CVE-2018-0171, Static Tundra and the Commands to Check Your Switches

NSA's message on October 21, 2026, was short: disable the Cisco Smart Install auto-loading feature on all network devices. The post re-shared a cybersecurity advisory first issued on August 7, 2017. Its three actions still apply word for word: disable Smart Install, review switch configuration files for deviations from documented configurations, and deny TFTP (UDP 69) and Smart Install (TCP 4786) at edge firewalls.

An eight-year-old advisory is back in circulation because the attacks never stopped. CVE-2018-0171, a 9.8 CVSS overflow in the Smart Install client, is in CISA's Known Exploited Vulnerabilities catalog. Cisco updated its advisory in August 2025 about continued exploitation. Cisco Talos and the FBI attributed a long-running campaign to a Russian FSB Center 16 group, which Talos calls Static Tundra. In July 2026, NSA and 17 partner agencies told organizations again to disable Smart Install, which "has no legitimate use case in most production environments." This post covers the protocol, the bug, what the attackers do, and the commands to check and fix your switches. The full analysis is in our CVE-2018-0171 database entry.

TL;DR

Two problems, one port

Smart Install lets a new switch (the client) receive its IOS image and configuration from a director, without anyone touching it. The client listens on TCP 4786 and, by design, does not authenticate the director. That creates two separate problems.

Protocol misuse (Cisco PSIRT, February 2017). Because the client trusts any director, an unauthenticated remote attacker can send legitimate Smart Install messages to change the startup-config, force a reload, load a new IOS image or run high-privilege CLI commands. This is what NSA's original advisory describes: adversaries "likely exfiltrating copies of configuration files on internet accessible switches."

CVE-2018-0171 (Cisco, March 2018). A crafted Smart Install message overflows a stack buffer in the client. Cisco lists the outcomes: a reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution. It is fixed in later IOS and IOS XE releases; Cisco says there is no workaround for customers who need the feature.

Disabling Smart Install closes both. Patching alone closes only the second.

What Static Tundra does with it

Cisco Talos published its Static Tundra analysis on August 20, 2025, the same day as an FBI public service announcement. Talos assesses with high confidence that the group is Russian state-sponsored, linked to FSB Center 16, and likely a sub-cluster of Energetic Bear (Berserk Bear). It has watched the group since 2015.

The chain Talos describes:

1. Mass targeting. Automated exploitation of CVE-2018-0171 against IP lists likely built from Shodan or Censys.
2. Config theft. Start a TFTP server on the switch and pull the startup configuration.
3. Credential reuse. Use SNMP community strings and credentials from the config. Some victims had public or anonymous strings with read-write rights. The group sometimes spoofs SNMP source addresses to pass ACLs.
4. Reconfiguration. Add local accounts, enable Telnet, change ACLs to allow attacker IPs, and alter TACACS+ settings to hinder remote logging.
5. Collection. Build GRE tunnels to redirect traffic of interest and collect NetFlow; use show cdp neighbors to find the next targets.
6. Persistence. Rely on stolen strings and new accounts; on some devices, the SYNful Knock firmware implant, which survives reboots and answers a crafted TCP SYN "magic packet."

Targets include telecommunications, higher education and manufacturing across North America, Asia, Africa and Europe, with a primary focus on Ukraine and its allies. The FBI noted interest in protocols used by industrial control systems.

Check your switches

On each Cisco IOS or IOS XE switch:

show vstack config
show tcp brief all | include 4786
show version

• Role: Client (SmartInstall enabled), or Oper Mode: Enabled with Role: Client, means Smart Install is on.
• A listener on *:4786 means the port is open.
• Feed the show version output into Cisco's IOS Software Checker to find the first fixed release.

NSA's note applies: these commands show whether the feature is enabled, not whether the device was compromised.

From outside, scan your own address space for TCP 4786. Any answer from the internet is an urgent finding.

Fix

configure terminal
 no vstack
end
write memory

Then:

1. Block at the edge. Deny TCP 4786 and UDP 69 inbound, ideally as part of deny-by-default. The July 2026 joint advisory also lists SNMP for perimeter blocking.
2. Upgrade to a fixed IOS or IOS XE release, even after disabling the feature.
3. Replace end-of-life switches that cannot run a fixed release. Talos notes many exploited devices are past end of life.
4. Harden management: SNMPv3 instead of community strings, SSH only on VTY lines, Type 8 local passwords and Type 6 TACACS+ keys, management ACLs and MFA.
5. Make configs centrally owned. Talos: "Do NOT allow devices to be the trusted source of truth for their configurations." Push configs from a store and diff against it.

Hunt for compromise

If a switch had Smart Install reachable, assume its configuration was read. Look for:

• Inbound connections to TCP 4786 and outbound TFTP or FTP from the switch
• Startup-config copies you did not schedule
• New local accounts, new read-write SNMP strings, Telnet enabled, ACLs opened to unknown IPs
• Changed TACACS+ or logging settings, or gaps in syslog and AAA logs
• GRE tunnels you did not create; unusual NetFlow export targets
• Talos IOCs: 185.141.24[.]222, 185.82.202[.]34, 185.141.24[.]28, 185.82.200[.]181
• SYNful Knock, using Talos's published scanner

Then rotate every credential and SNMP string that was in the configuration, because the attacker may have a copy.

Why this sits on an agent security blog

Two reasons. First, configuration files are credential stores. A stolen switch config gives an attacker SNMP strings, password hashes and a map of the network, the same pattern we see when AI-driven attacks harvest credentials in the cloud. Second, mass scanning for old, unpatched services is exactly the work that automation and agents make cheaper; the same week brought PHP2Shell, where attacks began before the patch. Old bugs on forgotten devices are the easiest targets for that tooling.

If you use AI agents to manage network gear, the same rules apply as for any administrator: least privilege, logged commands, reviewed changes. Beam records commands that coding agents run on developer machines; it does not watch network devices.

What people ask

"We never used Smart Install. Are we safe?"

Not necessarily. The client is on by default on older releases. Check with show vstack config.

"Is TCP 4786 open only internally? Is that fine?"

It lowers risk but does not remove it. An attacker with any internal foothold can reach it. Disable the feature.

"The NSA advisory is from 2017. Why act now?"

Because exploitation is ongoing in 2026, and devices that were never fixed are the ones attackers scan for.

Related reading

• CVE-2018-0171 analysis in the AgentBeam CVE database
• PHP2Shell and AI agents: why the attack window just collapsed
• Anatomy of an AI-driven cloud attack
• CERT-In: AI agents accessed Indian live systems
• Cisco Smart Install explained for everyone on explainx.ai

Primary sources: NSA advisory PDF · Cisco advisory cisco-sa-20180328-smi2 · Cisco Talos: Static Tundra · CISA KEV entry

Accurate as of October 21, 2026.