On October 21, 2026, the NSA posted a short reminder: Cisco users should turn off a feature called Smart Install on all their network devices. The advice is not new. It comes from an NSA advisory first published in August 2017. It is back because attackers, including a Russian state hacking group, are still using the feature to copy and change the settings of network equipment around the world.
This is a good story for anyone learning how security really works. The most dangerous bugs are often not brand new. They are old features that were left switched on and old fixes that were never installed. This post explains Smart Install in plain English, why an eight-year-old bug still works, who needs to act, and what to do. Network engineers who want the full command-level guide can read AgentBeam's technical breakdown.
The short version
| Question | Answer |
|---|---|
| What is Smart Install? | A Cisco feature that lets new switches set themselves up automatically |
| What is wrong with it? | It does not ask for a password, and it had a critical bug (CVE-2018-0171) |
| Who is attacking? | A Russian intelligence-linked group, plus others using public attack tools |
| What can they do? | Copy and change switch settings, steal passwords from them, spy on traffic |
| Does it affect home routers? | No. It is in Cisco business switches |
| What to do? | Turn it off (no vstack), block ports 4786 and 69, review settings |
First, what is a network switch?
In any office, school or data center, computers, printers, phones and servers plug into boxes called switches. Switches pass traffic between devices and on to the internet. Cisco makes a large share of them. Each switch has a configuration file: its settings, which include network layout, passwords (often in scrambled form) and access codes for management tools.
If an attacker gets that file, they get a map of the network and often the keys to other devices. If they can change it, they can quietly redirect traffic or let themselves back in later.
What Smart Install does, and why it is risky
Setting up hundreds of switches by hand is slow. Smart Install was Cisco's answer: a new switch "phones home" to a central device, downloads its software and settings, and configures itself. Convenient.
The catch is that the switch listens for those setup messages on network port 4786 and does not check who is sending them. Anyone who can reach that port can tell the switch to hand over its settings, load new ones, restart, or install different software. On many older Cisco software versions, Smart Install is switched on by default, even if nobody ever used it.
Cisco Smart Install left on by default, like a door that anyone can open
On top of that design problem, a coding bug was found in 2018: CVE-2018-0171. One specially crafted message to port 4786 could crash the switch or let the attacker run their own code on it. It is rated 9.8 out of 10. Cisco fixed it in 2018, and attack code has been public since then.
Why an old bug is still a big deal in 2026
There are three reasons, and they apply far beyond Cisco.
- Network gear is rarely updated. Switches sit in cupboards for a decade. Updating them means downtime, so it gets postponed. Many are past end of life and cannot get the fix at all.
- The feature was on by default. Many organizations never knew Smart Install was running.
- Scanning is cheap. Attackers use internet search engines for devices to find every switch answering on port 4786, then work through the list automatically.
The result: Cisco said in August 2025 that it was aware of continued exploitation. The same day, Cisco's threat research team, Talos, and the FBI described a Russian group linked to the FSB's Center 16, which Talos calls Static Tundra. According to Talos, it has exploited this bug since at least 2021, targeting telecom companies, universities and manufacturers in North America, Europe, Asia and Africa, with a focus on Ukraine and its allies. In July 2026, the NSA and 17 partner agencies repeated the advice to disable Smart Install, saying it "has no legitimate use case in most production environments."
What the attackers do once they are in
Cisco Talos describes the playbook. In plain terms:
- Copy the settings file from the switch.
- Reuse the passwords and access codes found in it to log into more devices.
- Change settings to add their own accounts and open remote access.
- Copy traffic of interest and send it to their own servers.
- Stay hidden by changing logging settings, and on some devices by installing modified software that survives a restart.
That is classic espionage: quiet, long-term access to how a network works and what flows through it.
Who needs to act?
| You are... | Do you need to act? |
|---|---|
| A home user | No. Your home router is not affected |
| A student learning networking | Not urgently, but this is a great real-world case study |
| A small business with a Cisco switch someone installed years ago | Yes. Ask your IT provider to check it |
| An IT team at a school, hospital, factory or office | Yes, today |
| A telecom or managed service provider | Yes, and hunt for past compromise |
What to do: the NSA's three steps
The NSA graphic sums it up in three lines. Here they are with plain explanations.
1. Turn off Smart Install
On each Cisco switch, an administrator checks whether the feature is on, then switches it off:
show vstack config
configure terminal
no vstack
end
write memory
If the first command shows "Role: Client (SmartInstall enabled)," the feature is on. no vstack turns it off, and write memory saves the change. After that, update the switch software to a fixed version if one is available.
2. Check your switch settings for changes
Compare each switch's current settings with a saved, known-good copy. Look for accounts nobody created, remote access (Telnet) switched on, or access rules that let in unknown addresses. If anything looks wrong, treat every password in that file as stolen and change them all.
Reviewing network switch logs and settings after the NSA Smart Install warning
3. Block the ports at your firewall
Block port 4786 (Smart Install) and port 69 (TFTP, the simple file transfer the attackers use to copy settings) at the edge of your network. Better still, block everything by default and only open what you need.
Where AI fits in this story
Smart Install is not an AI story on its face, but it connects to two trends we follow closely at explainx.ai.
First, automation makes old bugs more dangerous. Finding every exposed switch on the internet and trying an old exploit on each one is repetitive work that scripts and, increasingly, AI agents do well. The same week, PHP2Shell showed AI helping researchers find and exploit decade-old bugs in days. We have also covered AI attack swarms hunting zero-days and CERT-In's warning about AI agents accessing Indian organisations' live systems.
Second, teams are starting to let AI agents manage infrastructure. If an agent can log into your switches, it needs the same rules as a human admin: only the access it needs, every command recorded, and a person reviewing changes. Our coverage of security basics for AI agents goes deeper. AgentBeam, from the explainx.ai team, records the commands coding agents run on developer machines; for network devices, keep a central copy of every configuration and review every change.
Words you might see in other coverage
| Term | Plain meaning |
|---|---|
| Switch | A box that connects devices on a network |
| IOS / IOS XE | The operating systems that run on Cisco network equipment |
| Port 4786 | The network "door" Smart Install listens on |
| TFTP (port 69) | A very simple file transfer method with no passwords |
| Configuration file | A device's settings, often including passwords and access codes |
| SNMP community string | An old-style password for network management tools |
| CISA KEV | The US government's list of bugs known to be exploited |
| End of life | Hardware or software that no longer gets security fixes |
The lesson
Security news usually covers new bugs. The NSA's reminder is about the opposite: an old, known, fixed problem that keeps working because devices were never updated and a default setting was never changed. Whether it is a Cisco switch, an old PHP server or a Node.js app on last year's runtime, the boring work of inventory, updates and turning off what you do not use is still the best defense.
Related reading on explainx.ai
- PHP2Shell explained: what happened and what to do
- Node.js October 2026 security updates explained
- eMudhra explained: why a key equal to 4 mattered
- CERT-In advisory: AI agents accessed Indian organisations' live systems
- Armadin: AI attack swarms and 90 zero-days
- AgentBeam: technical guide to Cisco Smart Install and CVE-2018-0171
Sources: NSA advisory (PDF) · Cisco security advisory · Cisco Talos: Static Tundra · Cyber Security News on the July 2026 joint advisory · AgentBeam CVE-2018-0171 entry
Accurate as of October 21, 2026.