The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
An XCCDF Rule
Description
<VulnDiscussion>Network devices that are configured via a zero-touch deployment or auto-loading feature can have their startup configuration or image pushed to the device for installation via TFTP or Remote Copy (rcp). Loading an image or configuration file from the network is taking a security risk because the file could be intercepted by an attacker who could corrupt the file, resulting in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-216649r855812_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Disable configuration auto-loading if enabled using the following commands:
R8(config)#no boot network
R8(config)#no service config
Disable CNS zero-touch deployment if enabled as shown in the example below: