Cisco IOS XE Hardening Guide: Web UI, Smart Install, AAA and Device Integrity

Cisco IOS XE routers and switches are trusted to carry every packet in the network, yet many still run the web UI, Smart Install, Telnet and weak password types that attackers have used for years. In October 2023 CVE-2023-20198 in the IOS XE web UI let attackers create privilege 15 accounts and implant devices at scale, and Smart Install (CVE-2018-0171) was still being exploited in 2025. The IOS family has more entries in the CISA Known Exploited Vulnerabilities catalogue than almost any other product line. This guide covers administrator and machine identity on IOS XE, the hardening steps Cisco and the December 2024 CISA, NSA and Five Eyes communications infrastructure guidance set out, the logs that reveal tampering, and the common misconfigurations. It is for network engineers, architects and SOC teams. For the general edge device view, see the Edge Device Security Guide.

Key takeaways

• Turn off the HTTP server unless you need it. no ip http server always, and no ip http secure-server where the web UI and RESTCONF are not used; Cisco called this the interim mitigation for CVE-2023-20198.
• Disable Smart Install with no vstack. It listens on TCP 4786 on client switches and has no authentication; it remains a live exploitation target.
• Use Type 8 or Type 9 password hashes. CISA advises avoiding Type 5 and Type 7, and Salt Typhoon investigators found weakly protected passwords in stolen configurations that could be decrypted offline.
• Centralise AAA with TACACS+ and MFA. Command authorisation and accounting give a record of every change, with local accounts kept only for emergencies.
• Treat configurations as secrets and as evidence. They hold SNMP strings, AAA keys and VPN keys; store them centrally, compare against a golden copy and alert on changes outside change management.

How identity and access work in Cisco IOS XE

IOS XE runs on Catalyst switches, ISR and Catalyst 8000 routers, ASR 1000 and wireless controllers. Access control follows the classic IOS model.

• Privilege levels: 0 to 15, with 1 (user EXEC) and 15 (privileged EXEC, full control) used by default. A privilege 15 account can change anything, which is why CVE-2023-20198 attackers created one.
• Authentication sources: local usernames, the enable secret, and, after aaa new-model, AAA method lists that point at TACACS+ or RADIUS server groups with local fallback.
• Access paths: console and auxiliary lines, VTY lines (SSH; Telnet if not disabled), the web UI and RESTCONF over the HTTP or HTTPS server, NETCONF over SSH, SNMP, and Smart Install on switches.
• Machine identities: TACACS+ and RADIUS shared keys, SNMP communities or SNMPv3 users, NTP keys, routing protocol keys, IPsec pre-shared keys and certificates, SSH host keys, and accounts used by network automation, configuration backup and monitoring tools.
• Guest shell and application hosting: a Linux container on the device that can run scripts. Useful for automation, but another execution environment to control; CISA advises guestshell disable where it is not required.

Password and key storage types

Admin roles and privileged access

1. Enable AAA: aaa new-model, a TACACS+ server group, login authentication method list of TACACS+ then local, and exec and command authorisation for level 15 commands. CISA's guidance is that the AAA server should support MFA and should not be linked to the primary corporate identity store, so a compromise of the corporate directory does not hand over the network.
2. Account for every command: TACACS+ command accounting records who ran what. Locally, archive with log config, logging enable, hidekeys and notify syslog sends each configuration command to syslog with secrets masked.
3. Keep local accounts for emergencies only: one break-glass user with algorithm-type scrypt secret, stored in a vault and, per CISA, changed after every use. Remove any other local users, and alert on new ones. See the Break-Glass Account Guide.
4. Lock out guessing: aaa local authentication attempts max-fail for local accounts, and the login block feature to slow brute force on VTY lines.
5. Restrict VTY lines: transport input ssh, transport output none so the device cannot be used as a jump point, an access-class permitting only management hosts, and exec-timeout on console and VTY.
6. Strong SSH: SSH version 2 only, RSA keys of at least 3072 bits and Diffie-Hellman group 16, as the CISA guidance specifies.
7. Management plane protection: control-plane host with management-interface <interface> allow ssh https confines management protocols to the interfaces you name, ideally an out-of-band management network reached from dedicated administrative workstations. See the Network Device Management Plane Hardening Guide.

Services to disable or restrict

Integrations, API tokens and service accounts

• Automation accounts: configuration backup, NetBox or Ansible, monitoring and controller platforms log in over SSH, NETCONF (SSH on TCP 830) or RESTCONF (which runs on the HTTPS server). Give each tool its own TACACS+ account, authorise only the commands it needs, and store its credentials in a secrets manager. If RESTCONF is required, keep ip http secure-server but restrict it with ip http access-class and keep the web UI session modules disabled if you do not use the GUI (the advisory notes that ip http secure-active-session-modules none left HTTPS unexploitable for CVE-2023-20198).
• AAA shared keys: the TACACS+ key should be stored as Type 6 where supported. Salt Typhoon investigators reported attackers capturing SNMP, TACACS and RADIUS traffic, including shared secrets, so rotate keys after any suspected compromise and prefer TACACS+ over TLS or IPsec-protected transport where available. See the RADIUS Security Guide.
• SNMP: read-write communities are effectively configuration credentials. Remove them, use SNMPv3 users with priv, and restrict by ACL and view. See the SNMP Security Guide.
• Configuration backups: the backup server holds every device secret. Encrypt backups at rest, restrict who can read them, and pull them over SCP rather than TFTP or FTP.
• Keys for routing and time: authenticate NTP (ntp authenticate, trusted keys) and routing protocols, and rotate those keys with the same discipline as passwords.

The Salt Typhoon telecom intrusions show how this plays out: Cisco Talos found that in most cases the attackers logged in with valid credentials, then pulled configurations over TFTP or FTP containing SNMP read-write strings and weakly encrypted local passwords, and used them to move further. See the Non-Human Identity (NHI) Guide for treating these device credentials as managed identities.

Logging and detection

Cisco's hardening guide sets logging host, logging trap 6, a local buffer at level 6, no logging console and no logging monitor, a fixed logging source-interface, and service timestamps log datetime msec show-timezone. CISA adds that remote log traffic should be encrypted (for example over IPsec or TLS) and that copies should be kept off the device, because the device is the first thing an attacker will tamper with.

CISA's guidance is to store configurations centrally rather than treating the device as the source of truth, compare them frequently, and alert on deviations. Flow monitoring at key ingress and egress points shows traffic the device logs will not. See the Network Device Syslog and Configuration Change Detection Guide.

Metrics

• HTTP server exposure: count of devices with ip http server or an unrestricted ip http secure-server (target: zero unrestricted).
• Smart Install: devices answering on TCP 4786 in internal scans (target: zero).
• Weak hashes: devices with any Type 0, 5 or 7 secret in configuration.
• AAA coverage: percentage of devices with TACACS+ authorisation and command accounting.
• Configuration drift: devices differing from the golden configuration, and time to explain each difference.
• Patch latency: days from a Cisco Critical or High IOS XE advisory to fixed code on exposed devices.

Hardening baseline

1. Find exposure first: scan for HTTP, HTTPS, Telnet, SNMP and TCP 4786 on all device addresses, from outside and from user networks. Run show running-config | include ip http server|secure|active and show vstack config across the estate with your automation tool.
2. Remove the worst services: no ip http server, no vstack, Telnet off, SNMP v1 and v2c off. Push to a pilot group (one site or lab) first and check monitoring and automation still work. Save with copy running-config startup-config once validated; roll back by reloading the saved startup configuration or reapplying the archived copy.
3. Patch: move to fixed releases for KEV-listed vulnerabilities using the Cisco Software Checker, and verify image signatures with show software authenticity file before and after upgrade.
4. Rebuild AAA: TACACS+ with MFA, command authorisation and accounting, one scrypt-hashed local break-glass account, VTY access-class and SSH-only transport. Enable command authorisation on a pilot device first; keep a console session open while testing so a mistake does not lock you out.
5. Rotate secrets: replace Type 5 and 7 secrets, rotate SNMP, TACACS+, RADIUS, NTP and routing keys, and store recoverable keys as Type 6.
6. Logging and integrity: remote encrypted syslog, archive logging, NTP authentication, golden configuration comparison, and flow monitoring at key points.

Framework mapping

ISO/IEC 27001:2022 Annex A equivalents are A.8.2, A.8.5, A.8.8, A.8.9, A.8.15, A.8.20 and A.8.24 (use of cryptography).

Common misconfigurations

• Web UI left on by default image settings: many devices ran ip http server or ip http secure-server without anyone using the GUI, which is how CVE-2023-20198 reached so many devices.
• Smart Install still active on access switches: the feature exists for zero-touch deployment and is rarely needed afterwards; Cisco still reported exploitation in 2025.
• Type 7 passwords and read-write SNMP communities in backups: one stolen configuration hands over device and neighbour credentials, the pattern in the Salt Typhoon intrusions.
• AAA tied to the corporate directory without MFA: a phished or sprayed corporate password becomes network admin access. CISA advises a separate AAA identity store with MFA.
• No outbound restriction on VTY: without transport output none, a compromised device becomes a hop to other devices.
• Patching without hunting: fixing CVE-2023-20198 removed the flaw but not the attacker-created local users, so check for unknown accounts and configuration changes as part of every emergency patch. See the Emergency Out-of-Band Patching Playbook.

Practitioner checklist

• Disable ip http server everywhere, and ip http secure-server unless required; restrict it with ip http access-class where kept.
• Run no vstack on every switch and confirm TCP 4786 is closed.
• Allow only SSH version 2 on VTY lines, with an access-class, transport output none and exec timeouts.
• Use TACACS+ with MFA, command authorisation and accounting; keep one scrypt-hashed, vaulted local account.
• Remove Type 0, 5 and 7 secrets; store recoverable keys as Type 6; rotate SNMP, AAA, NTP and routing keys.
• Move to SNMPv3 with privacy, ACLs and views; remove read-write communities.
• Send encrypted syslog off the device, enable archive logging and alert on configuration changes outside change windows.
• Compare running configurations with a centrally stored golden copy and verify image signatures after every upgrade.
• Patch KEV-listed IOS XE vulnerabilities and hunt for unknown local users after each emergency patch.

Standards and references

• Cisco: IOS XE Software Hardening Guide
• CISA, NSA, FBI and partners: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• Cisco: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature
• Cisco: IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Data from Configuration Repository

Related NHI Mgmt Group resources: Edge Device Security Guide · Network Device Management Plane Hardening Guide · Vulnerability Management for Network Devices Guide · Cisco ASA and Firepower Threat Defense Hardening Guide