Cisco Smart Install CVE-2018-0171 Exploitation by FSB

Recent threat intelligence highlights the persistent exploitation of CVE-2018-0171, a critical remote code execution (RCE) vulnerability in Cisco's Smart Install client, by Russian state-sponsored actors including FSB Center 16 and the group Static Tundra. Despite being disclosed in 2018, the vulnerability remains a high-value target because it allows unauthenticated attackers to send crafted packets to TCP port 4786, resulting in device reloads or full administrative control.

Technical analysis indicates that actors use this access not only for immediate execution but as a gateway for protocol misuse, enabling the exfiltration of startup configurations via TFTP and the modification of SNMP settings for long-term persistence. This activity has targeted U.S. critical infrastructure sectors, focusing on poorly configured network devices and end-of-life equipment that lacks modern security controls. Defenders must treat an open TCP 4786 port as a critical exposure that requires immediate remediation through patching or disabling the vstack service.