Regarding this bug, Does the password-recovery disable feature should be disabled in order to exploit this vulnerability?
Determine Whether the Password-Recovery Disable Feature is Enabled
To determine whether the password-recovery disable feature is enabled, log in to the device and use the show romvar | include SWITCH_DISABLE_PASSWORD_RECOVERY CLI command. The following example shows the output of a device that has the password-recovery disable feature enabled (SWITCH_DISABLE_PASSWORD_RECOVERY value is "1"):
Switch# show romvar | include SWITCH_DISABLE_PASSWORD_RECOVERY
SWITCH_DISABLE_PASSWORD_RECOVERY="1"
If the value is "0" or the SWITCH_DISABLE_PASSWORD_RECOVERY is not shown in the show romvar CLI command, the password-recovery disable feature is not enabled.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjO
