CSCvg76186 - Cisco Smart Install Remote Code Execution and Denial of Service Vulnerability - 6

VAIBHAVBHARDWAJ30047 · ‎09-25-2019

I have two cisco WS-C4507R+E (MPC8572) processor (revision 11), currently running with system image "bootflash:cat4500e-universal.SPA.03.06.07.E.152-2.E7.bin"

I want to fix this vulnerability, kindly suggest firmware or system image version which has the fix. If possible kindly provide the link for download.

I have attached the file for more detail.

Thank you.

Leo Laohoo · ‎09-25-2019

Use the command "no vstack" or "no vstack config" to disable this feature.

VAIBHAVBHARDWAJ30047 · ‎09-25-2019

Thanks. I have one more query. If I disable this feature then this vulnerability will be detected by security tools which are used to find vulnerabilities?

What is your opinion?

Leo Laohoo · ‎09-26-2019

Smart Install isn't just switches. It is switches and routers.
The command must be added to all routers and switches.
If you really want to do an IOS upgrade, then look for IOS/IOS-XE files that were published AFTER June 2018. IOS files published after June 2018 does not support Smart Install.