Port 2000 / 4786 – Cisco SCCP / Smart Install

Ports 2000 and 4786 belong to two Cisco services — SCCP (Skinny) VoIP call control on 2000, and Smart Install on 4786 — that share a page because both turn up on Cisco gear and both are frequently left listening where they shouldn’t be. TCP 2000 is IANA-registered as cisco-sccp: the Skinny Client Control Protocol, Cisco’s proprietary signalling between IP phones and CallManager/CUCM. TCP 4786 is Cisco Smart Install (SMI), a zero-touch provisioning feature for switches — and it is the dangerous half of this pair. Smart Install has no authentication by design, so anyone who can reach port 4786 can pull the switch’s running config, push a new one, or take the device over completely. Smart Install is the reason this pairing shows up on nearly every network pentest of a Cisco estate.

Why It’s Open

Smart Install (4786) is a director/client feature that lets a new Cisco IOS/IOS-XE switch pull its image and configuration automatically when it’s racked. The problem is that the client role stays on by default on many Catalyst switches long after provisioning is finished — the switch keeps answering on 4786 with no way to authenticate the “director” talking to it. Cisco flagged mass internet scanning for exposed SMI clients as far back as 2017, and researchers have repeatedly found well over 100,000 switches exposing it to the internet.

SCCP (2000) is open wherever Cisco IP phones register to a CallManager/CUCM cluster or to Communications Manager Express on a router. It’s meant to live entirely inside the voice VLAN, but flat networks, misconfigured trunks, and management interfaces bound to the wrong VLAN routinely leave 2000 reachable from user subnets — or, worse, the internet. If you’re mapping a VoIP estate, treat 2000 as one signalling port among several and check its siblings too: H.323 on port 1720 and SIP on port 5060. Device management on the same switches usually rides SSH on port 22 or legacy Telnet on port 23.

Common Risks

• Smart Install config theft (no auth). Because SMI has no authentication, an unauthenticated attacker on the network sends a crafted “director” message and copies the switch’s running-config out to a TFTP server they control. That config contains enumerable secrets: local passwords (often weak type-7), SNMP community strings, VTY ACLs, and the whole topology.
• Smart Install full device takeover. The same feature abuse lets an attacker overwrite startup-config, push a malicious IOS image, or run privileged CLI commands — effectively owning the switch and everything routed through it.
• Smart Install RCE (CVE-2018-0171). A buffer overflow in the SMI code path allows unauthenticated remote code execution or a forced reload — CVSS 9.8, and abused in real mass-compromise campaigns.
• SCCP eavesdropping and call manipulation. Unencrypted Skinny signalling on 2000 exposes device type, MAC, and firmware in registration traffic, and enables registration spoofing, call teardown, and man-in-the-middle against VoIP calls when signalling isn’t secured.
• SCCP denial of service and injection. Malformed Skinny messages have crashed CallManager processes (CVE-2010-0588) and even reached SQL injection via crafted registration (CVE-2011-4487).
• Lateral movement. A switch config lifted over 4786 hands an attacker the credentials and SNMP strings to pivot deeper — Smart Install is a foothold, not just an information leak.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect both services and grab versions

nmap -sV -p 2000,4786 <target>

Nmap fingerprints 2000 as cisco-sccp and 4786 as smart-install — an open 4786 alone is a finding worth escalating.

Smart Install (4786) — scan and download the config with Metasploit

The verified module is auxiliary/scanner/misc/cisco_smart_install (default RPORT 4786). Its SCAN action fingerprints the SMI service; its DOWNLOAD action copies the running config to an embedded TFTP server.

msfconsole -q
use auxiliary/scanner/misc/cisco_smart_install
set RHOSTS <target>
set ACTION SCAN
run

# Pull the running-config off an exposed switch (no auth)
set ACTION DOWNLOAD
run

Smart Install (4786) — SIET (Smart Install Exploitation Tool)

SIET (siet.py, from Sab0tag3d/SIET) is the standard open-source SMI tool. -i is the target, -t tests, -g downloads the config, -e runs console commands via TFTP.

# Test whether the device speaks Smart Install
python3 siet.py -t -i <target>

# Download the running-config
python3 siet.py -g -i <target>

# Execute commands from tftp/execute.txt on the device
python3 siet.py -e -i <target>

SIET also ships cisco-siet.nse to check exploitability from nmap, and Cisco Talos publishes a read-only scanner (Cisco-Talos/smi_check) for confirming exposure without touching config.

SCCP (2000) — inspect the Skinny signalling

# Confirm the SCCP service
nmap -sV -p 2000 <target>

Capture and read Skinny with Wireshark’s built-in dissector — filter on skinny or tcp.port == 2000 and watch for RegisterMessage / KeypadButtonMessage frames, which leak device type, MAC address, and firmware and reveal whether signalling is encrypted.

Record every open 4786, every config you pull, and every credential or SNMP string it contains as you go, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

• CVE-2018-0171 — The headline flaw. A buffer overflow (out-of-bounds write) in the Smart Install feature of Cisco IOS and IOS XE on TCP 4786 lets an unauthenticated remote attacker crash the device or run arbitrary code. CVSS v3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Cisco advisory cisco-sa-20180328-smi2; PoC crash on Exploit-DB 44451.
• Smart Install protocol misuse (cisco-sa-20170214-smi) — Not a CVE — a feature-abuse issue. SMI has no authentication or authorization, so an attacker who reaches 4786 can send crafted messages as if from the Smart Install director: change the TFTP server, copy running-config out, replace startup-config, load an attacker-supplied IOS image, or run high-privilege CLI. This is the config-theft path exercised by SIET and Metasploit, and it works even on IOS that’s patched against CVE-2018-0171 — the fix is to disable the feature, not to update.
• CVE-2018-0156 — Improper packet validation in Smart Install on TCP 4786 lets an unauthenticated attacker reload an affected switch. Denial of service only — CVSS v3.1 7.5 High (C:N/I:N/A:H). (Not a config-disclosure bug; it’s availability impact.)
• CVE-2010-0588 — SCCP (2000). A malformed Skinny message (RegAvailableLines or FwdStatReq with an invalid line number) crashes a CUCM process — unauthenticated remote DoS. CVSS v2 7.8 High.
• CVE-2011-4487 — SCCP (2000). A crafted SCCP registration reaches a SQL injection in Cisco Unified Communications Manager, letting a remote attacker run arbitrary SQL. CVSS v2 6.8 Medium.

Removed from the previous version of this page: CVE-2018-0172 was mislabelled here as “privilege escalation via Smart Install.” It is actually a DHCP option-82 heap-overflow DoS in IOS/IOS XE — unrelated to Smart Install or ports 2000/4786 — so it’s out of scope. CVE-2018-0156 was also corrected from “config file disclosure” to its real DoS scope.

Mitigation

• Disable Smart Install — this is the #1 fix. On any switch that isn’t actively being provisioned, run no vstack in global config and confirm with show vstack config. Cisco’s own guidance is to turn the feature off; it removes the entire 4786 attack surface, including the CVE-2018-0171 RCE and the unauthenticated config theft.
• Firewall TCP 4786. If Smart Install genuinely must stay on for staging, restrict 4786 with an interface ACL to the provisioning/management range only, and never expose it to user VLANs or the internet.
• Patch IOS/IOS XE to a build fixed against CVE-2018-0171 and CVE-2018-0156 — as defence in depth, not a substitute for no vstack.
• Lock SCCP to the voice VLAN. Restrict TCP 2000 (and 2443) to the CUCM/CallManager appliances and IP phones that need it; keep it off user and WAN subnets.
• Use encrypted, authenticated signalling. Deploy CUCM in mixed/secure mode so phones use TLS-protected signalling instead of cleartext Skinny, and patch CUCM for the SCCP DoS/SQLi issues above.
• Rotate anything a stolen config exposed. If 4786 was reachable, treat the switch passwords and SNMP community strings as compromised and change them.

Real-World Example

In April 2018, attackers weaponised the Smart Install protocol abuse — not a zero-day, just the unauthenticated feature — to hit tens of thousands of exposed switches worldwide. Reaching TCP 4786, they overwrote the startup-config, forced a reload, and left many switches unusable with a banner reading “Do not mess with our elections.” Kaspersky and Cisco Talos tracked well over 100,000 affected devices, with concentrations in the US and Iran. In the same period, US-CERT alert TA18-106A documented Russian state-sponsored actors leveraging exposed Smart Install to enumerate and reconfigure network infrastructure. The campaign is the textbook lesson for this port: the damage came from a feature left on by default, reachable with no credentials, long after any switch needed it — which is exactly why “is 4786 answering?” is a standard line in a Cisco pentest.

FAQ

What is port 4786 used for?

Port 4786/TCP is Cisco Smart Install (SMI), a zero-touch provisioning feature that lets a new IOS/IOS-XE switch pull its image and configuration automatically. The feature has no authentication, so an exposed port 4786 lets anyone on the network download or replace the switch’s configuration.

What is Cisco Smart Install and why is it dangerous?

Smart Install is a director/client provisioning feature that stays enabled by default on many Catalyst switches. Because the protocol authenticates nobody, an attacker who reaches TCP 4786 can steal the running config, push a malicious one, load a rogue IOS image, or trigger the CVE-2018-0171 remote code execution (CVSS 9.8). Cisco’s fix is to disable it with no vstack.

What is port 2000 (Cisco SCCP)?

Port 2000/TCP is Cisco’s Skinny Client Control Protocol (SCCP), the proprietary signalling between Cisco IP phones and a CallManager/CUCM cluster. It’s meant to stay inside the voice VLAN; exposed on user or WAN subnets it enables VoIP eavesdropping, registration spoofing, and, on unpatched CUCM, DoS or SQL injection.

How do I check if a switch is exposed to Smart Install?

Scan TCP 4786 with nmap -sV -p 4786 <target>, then confirm exposure with a read-only tool like Cisco Talos smi_check or Metasploit’s auxiliary/scanner/misc/cisco_smart_install in SCAN mode. If the service answers, it’s exposed — disable it with no vstack.

How do I secure ports 2000 and 4786?

For 4786, disable Smart Install with no vstack (the primary fix), firewall the port if provisioning still needs it, and patch IOS for CVE-2018-0171. For 2000, restrict SCCP to the voice VLAN and CUCM appliances, enable TLS-protected signalling, and patch CUCM. Rescan to confirm both ports are closed to untrusted networks.

TL;DR

• Service: Cisco SCCP / Skinny (2000/TCP) — IP phone call control; Cisco Smart Install (4786/TCP) — zero-touch switch provisioning
• Default ports: 2000/TCP (SCCP), 4786/TCP (Smart Install)
• Biggest risk: unauthenticated Smart Install on 4786 — config theft, full switch takeover, and CVE-2018-0171 RCE (CVSS 9.8); SCCP on 2000 adds VoIP eavesdropping and CUCM DoS/SQLi
• Mitigation: disable Smart Install with no vstack (the #1 fix), firewall 4786, patch IOS; restrict SCCP to the voice VLAN with encrypted signalling