Critical Infrastructure at Risk: Advanced Actors Target Smart Install Client
Summary: Cisco Talos reported that advanced actors, some believed tied to nation-states, are targeting Cisco switches through protocol misuse in the legacy Smart Install Client, with incidents in multiple countries including attacks on critical infrastructure. Talos used Shodan to find more than 168,000 systems potentially exposed via the Smart Install Client, down from the 251,000 Tenable reported in 2016, and observed a sharp increase in scanning on or around Nov. 9, 2017.
Bottom line: The protocol can be abused to modify TFTP settings, exfiltrate configuration files, replace the IOS image, and set up accounts for executing IOS commands - and with more than 168,000 systems still exposed, the population of reachable switches remains large enough for nation-state actors to work through.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026