Remediation Guides

Cisco Smart Install Detection: How to Disable It with no vstack and Block TCP 4786

26 September 2026 8 min read

Cisco Smart Install Detection means a Cisco IOS or IOS XE switch is still running Smart Install, a zero-touch provisioning protocol with no authentication, on TCP port 4786. Fix it by running no vstack in global configuration mode, saving the configuration, and blocking TCP 4786 with an ACL wherever the command is missing or Smart Install is still needed.

Nessus rates this finding as informational, and Cisco does not call it a vulnerability. Treat it as a configuration issue that gives anyone who can reach the port unauthenticated control of the switch.

What the scanner is actually detecting

Tenable Nessus reports this as Cisco Smart Install Detection, plugin ID 105161. It is a remote check in the Service detection family, severity Info, and its synopsis states that the Cisco Smart Install feature is enabled on the remote host. The plugin references Cisco advisory cisco-sa-20170214-smi, and its solution is to disable Smart Install if it is not needed.

A related plugin, Cisco IOS Smart Install Protocol Misuse (cisco-sr-20170214-smi), ID 99233, reaches the same conclusion from a credentialed scan. It is in the CISCO family and requires local checks and the detected IOS version, so it only appears when Nessus has logged in to the switch.

Some background helps when reading either result. A Smart Install network has one director (a switch or router) and one or more client switches. Cisco states that the feature is enabled by default on client switches and that only clients are affected by the protocol misuse. A switch that was deployed years ago and never touched again is the typical hit.

Real-world risk

The Smart Install protocol has no authentication or authorization by design. According to Cisco, an attacker who can send Smart Install messages to a client can:

  • change the TFTP server address the client uses;
  • copy arbitrary files from the client, such as the startup configuration with its password hashes and SNMP communities, to an attacker-controlled TFTP server;
  • replace the startup configuration and force a reload after a set interval;
  • load an attacker-supplied IOS image;
  • run configuration mode commands (IOS 15.2(2)E and later, IOS XE 3.6.0E and later).

This is not theoretical. Cisco’s advisory notes a significant increase in Internet scans looking for switches with Smart Install left enabled. A separate code flaw in the same feature, CVE-2018-0171 (CVSS 9.8, advisory cisco-sa-20180328-smi2), is a buffer overflow triggered by a crafted message to TCP 4786 that can reload the device or execute code. CVE-2018-0171 and the Smart Install denial of service flaw CVE-2018-0156 are both in the CISA Known Exploited Vulnerabilities catalog (see how the CISA KEV catalog works). In August 2025 Cisco Talos reported that Static Tundra, a group it links to the FSB’s Center 16, has for years exploited CVE-2018-0171 on unpatched, often end-of-life Cisco devices and exfiltrated their configurations.

Urgency depends on reachability. A switch whose management address is reachable from the Internet needs action today. One reachable only from a locked-down management network is lower risk, but any compromised host inside that network gets the same unauthenticated access.

How to confirm it on the device

Log in to the switch and run:

show vstack config

Cisco lists these outputs as meaning the Smart Install client is enabled:

Role: Client
Role: Client (SmartInstall enabled)
Capability: Client
Oper Mode: Enabled
Role: Client

Record the software release, because it decides which fix applies:

show version

From a workstation, you can check whether the port answers, remembering Cisco’s warning that TCP 4786 is also used by other protocols, so an open port alone is not proof:

nmap -Pn -p 4786 192.0.2.10

Then look for signs that the feature was already abused. Cisco lists log messages such as %SMI-6-UPGRD_STARTED, %SYS-5-CONFIG_NV_I with a tftp:// source, and reload reasons mentioning SMI IBC Download Process or HULC SMI Scheduled Reload. Talos also saw attackers enable a TFTP server for the startup configuration. Check both, and search your syslog server as well:

show logging | include SMI|CONFIG_NV_I
show running-config | include tftp-server

A line such as tftp-server nvram:startup-config that you did not add is a strong indicator of compromise.

How to fix it

Smart Install not in use (most networks)

Disable the feature and save the change. Cisco documents no vstack as the global configuration command that disables Smart Install and shuts down its TCP ports, on a client or a director:

configure terminal
 no vstack
 end
copy running-config startup-config

If you still use Smart Install only for zero-touch deployment, Cisco recommends adding no vstack to the configuration pushed to each new client, so it turns itself off once provisioned. For many switches, push the same two lines with your usual configuration automation.

Releases where no vstack does not exist

The command arrived with the fix for Cisco bug CSCtj75729. If the parser rejects no vstack, block TCP 4786 on every IP interface of the switch and plan an upgrade. Replace Vlan10 with each SVI or routed interface that has an address:

configure terminal
 ip access-list extended SMI_BLOCK
  deny tcp any any eq 4786
  permit ip any any
 exit
 interface Vlan10
  ip access-group SMI_BLOCK in
 end
copy running-config startup-config

An interface takes one inbound IPv4 ACL. If one is already applied, add the deny line near the top of that list rather than replacing it.

Smart Install still needed beyond zero-touch

Cisco’s guidance is to let only the director reach clients on TCP 4786. Its example, with director 10.10.10.1 and client 10.10.10.200, is:

ip access-list extended SMI_HARDENING_LIST
 permit tcp host 10.10.10.1 host 10.10.10.200 eq 4786
 deny tcp any any eq 4786
 permit ip any any

Apply it to all IP interfaces on all clients, and add infrastructure ACLs at your network edge that drop TCP 4786 toward switch management ranges. Cisco recommends migrating to Network Plug and Play, which adds authentication, for long-term use.

Releases where the setting does not persist

Because of Cisco bug CSCvd99197, no vstack does not survive a reload on 12.2(60)EZ11, 15.1(2)SY11, 15.2(1)SY5, 15.2(2)SY3, 15.2(5)E2, 15.2(5)E2a, 15.2(5)E2b, 15.4(1)SY3, 3.9.2E, 3.9.2aE and 3.9.2bE. Cisco advises moving to an unaffected release or automating reapplication of the command after every reload.

Upgrade

Cisco states that in releases containing the fix for bug CSCvd36820, Smart Install disables itself automatically when not in use. Upgrading also fixes CVE-2018-0171, for which Cisco says there are no workarounds for customers who need Smart Install. Enter your release in the Cisco Software Checker to find the first fixed release for your platform.

How to verify the fix and rescan

  1. Run show vstack config. Cisco’s sample output for a disabled client is Role: Client (SmartInstall disabled).
  2. Run show startup-config | include vstack and confirm the no vstack line was saved.
  3. From a host outside the management network, nmap -Pn -p 4786 against the switch should no longer report the port as open.
  4. After the next planned reload, repeat step 1, especially on the releases affected by CSCvd99197.
  5. Rescan. Plugin 105161 should stop reporting, and plugin 99233 should clear on a credentialed rescan.

What can break and how to roll back

  • Zero-touch provisioning. Disabling Smart Install on the director stops new switches from receiving images and configurations, and vstack director and vstack basic are refused while it is disabled. To roll back, enter vstack in global configuration mode. Cisco notes that if the configuration changed while the feature was off, you should run write memory on clients after re-enabling it.
  • ACL lockout. Leaving out permit ip any any blocks all traffic through the implicit deny. When working remotely, run reload in 10 before applying the ACL and reload cancel once you confirm access, without saving in between. Remove a bad ACL with no ip access-group SMI_BLOCK in on the interface.
  • Upgrades reload the switch, so schedule an outage window.

Common false positive reasons

  • Another service on TCP 4786. Cisco PSIRT warns that an open port 4786 alone can be a false positive, because other protocols use it. If the host is not a Cisco switch, or show vstack config shows Smart Install disabled, collect that output as evidence.
  • Director, not client. The misuse and CVE-2018-0171 affect clients only. A director that answers on 4786 is still running Smart Install, so disable it if unused, but its risk is different.
  • Restricted by design. If you kept Smart Install with an ACL and the scanner sits on a permitted path, the finding is accurate but mitigated. Record it as an accepted exception.
  • Setting lost on reload. A finding that returns after a maintenance window usually means CSCvd99197, not a scanner error.

FAQ

Does no vstack require a reload?

No. It is a global configuration command that disables Smart Install and shuts its TCP ports. Save the configuration so it survives the next reload.

Why is it rated Info if the impact is so serious?

Plugin 105161 detects an enabled feature, not a software flaw. Cisco’s own advisory is rated Informational and describes the issue as misuse of a protocol that does not require authentication by design. The impact on an exposed client is still full configuration control.

Does disabling Smart Install fix CVE-2018-0171?

It removes the attack path, and Cisco and Talos give it as the option when patching is not possible. The vulnerable code remains, so still upgrade to a fixed release.

Should I disable it on the director too?

Yes, if you no longer provision switches with Smart Install. Cisco documents no vstack for both clients and directors.

Tracking this finding across many switches

Smart Install tends to linger on older access switches spread across many sites, so the real work is knowing which switches reported plugin 105161, which were fixed, and which came back after a reload. SITEY, a self-hosted vulnerability management platform, imports Nessus results from an uploaded .nessus export and supports per-finding retest for Nessus findings, so you can confirm 105161 has closed on each switch. Its AI triage can suggest false positives with evidence, and a human makes the final call.

Sources

SITEY closes the loop, not just the report.Discover, validate, fix and verify in your own infrastructure.

See pricing
← All articles