id: cisco-smi-exposure

info:
  name: Cisco Smart Install Endpoints Exposure
  author: dwisiswant0
  severity: info
  description: |
    This template attempts & supports the detection part only by
    connecting to the specified Cisco Smart Install port and determines
    if it speaks the Smart Install Protocol. Exposure of SMI to
    untrusted networks can allow complete compromise of the switch.
  reference:
    - https://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html
    - https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature
    - https://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20170214-smi
    - https://github.com/Cisco-Talos/smi_check/blob/master/smi_check.py#L52-L53
    - https://github.com/Sab0tag3d/SIET
  tags: network,cisco,smi,exposure

network:
  - inputs:
      - data: "000000010000000100000004000000080000000100000000"
        type: hex

    host:
      - "{{Hostname}}"
      - "{{Host}}:4786"

    matchers:
      - type: word
        encoding: hex
        words:
          - "000000040000000000000003000000080000000100000000"