Cisco Software Download C9300

0 views

Skip to first unread message

Salvator Grimard

unread,

Aug 3, 2024, 10:43:45 AM8/3/24

to theftchichanve

A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust.

This vulnerability is due to errors that occur when retrieving the public release key that is used for image signature verification. An attacker could exploit this vulnerability by modifying specific variables in the Serial Peripheral Interface (SPI) flash memory of an affected device. A successful exploit could allow the attacker to execute persistent code on the underlying operating system.

Note: In Cisco IOS XE Software releases 16.11.1 and later, the complexity of an attack using this vulnerability is high. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software on a device to a release that would lower the attack complexity.

This vulnerability affects Cisco Catalyst 9300 Series Switches if they are running Cisco IOS XE Software with a release of Cisco IOS XE ROM Monitor (ROMMON) that is earlier than Release 17.3.7r, Release 17.6.5r, or Release 17.8.1r.

To determine the Cisco IOS XE ROMMON release that is running on the device, use the show version include BOOTLDR command on the device CLI. The following example shows the output of the show version include BOOTLDR command on a device that is running Cisco IOS XE ROMMON Release 17.6.1r:

Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.

Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
-user-license-agreement.html

Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.

When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: -cisco-worldwide-contacts.html

To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

EDIT 13-Jan-2020 - I found an ideal solution for my issue with the help of the posts below and a lot of searching around the Cisco documentation. In my case, I wanted to get back to the WebUI's "Day 0 configuration" tool to attempt to configure the switch that way rather than through command line. Here's what I did:

What makes this fix work for me is that is clears the stored configuration files in NVRAM and re-installs the IOS software completely. There was even a console message following the emergency-install saying "Checking backup nvram / No config present. Using default config". That was a very satisfying message to see, in my case.

I have a brand new, fresh out of the box Cisco C9300-48T-E-V02 switch running IOS 16.9.4 software. I have been following the Cisco Catalyst 9300 Series Switches Hardware Installation Guide to set it up, and was in the process of Chapter 7, "Configuring the Switch Using the Web User Interface".

When I reached the end of the Day 0 configuration wizard, I was met with a message that my session had timed out and I would need to login again. When I attempted to login again, the login credentials (username: webui, password: serial number of switch) were rejected.

Is there any way to "reset" the switch such that I can run the Day 0 configuration wizard again? I have the ability to connect to the switch through the console and have successfully been able to enter CLI commands (note I did not connect to the console until *after* I was locked out of the web interface).

I apologize, I'm not sure which section of the document you linked would help me get the switch past ROMMON mode and booted completely. Would you be able to elaborate on that? (Also my ROMMON issue is actually on a separate, second switch from the one I'm asking about the web interface for)

Ok, so we are dealing with 2 different issues here, one is the switch that only boots to ROMMON and the other one is the switch that boot the IOS and you are able to console to it and logon to the device and make changes. Is that correct? If this is correct, for the switch you have access to via console/CLI, you don't need password recovery, all you need is to create a username and give it password you desire.

Also, as far as the loading a config file. Cisco does not provide any config file, the only thing Cisco provides is the IOS (the operating system for the device) you have to build the config yourself as it differs for every implementation.

I followed the password recovery procedure you linked, but when I reach Step 6 of the "Procedure with Password Recovery Enabled" section I run into an issue. It appears Step 6 is perhaps missing the Switch(config)# command to change the enable password? I found that elsewhere ("enable password ******", new line, then "end"). Then Step 7 still shows the "(config)" flag on the command prompt, is that right? I wasn't able to issue a "copy" command to "Switch(config)#" but was able to issue the "copy" command in Step 7 once I was back out at just "Switch#" level. Then in Step 8, when I issue the "show boot" command, I am met with a message saying "Current Boot Variables: BOOT variable does not exist ..... Boot Variables on next reload: BOOT variable = flash:packages.conf / Manual boot = no ..." and so on.

If you have access to the switch through the console and you are able to logon and make changes than there is no need for password recovery. All you have to do is to change the username and password to what you want to be.

My understanding of the Day 0 configuration wizard, through the switch's web interface, can only be accessed initially using the "webui / serial number" user credentials. The serial number is printed on a label on the switch so I have no trouble getting the serial number. The issue is that once those login credentials have been used once, it appears they are then disabled from further use. The first step of the Day 0 configuration wizard is to create a privileged user account, but as I was never able to finish the wizard (my session timed out prior to the final "Submit" button), that privileged user account was never created BUT my Day 0 credentials (webui / serial number) also no longer work.

Perhaps the better question is: is there a way through the command line for me to reset all settings on the switch to factory defaults? I don't have any configuration I'm losing at this stage so the ideal scenario would be resetting the switch back to as if it were fresh from the box. Note that I already tried the "factory-reset all" command from this page: [cisco.com] ... on another switch and it is left with just the ROMMON mode, which is another issue I'm troubleshooting :-(

I have never used the web interface on any Cisco device but I know as long as you have access to the switch through the console/cli than you can make any changes you want including factory rest, erase the config, etc...

Also, does Cisco provide basic configurations anywhere? For example could I download a basic configuration file, load it to a USB drive, and use the C9300's front USB-A port to load that configuration file to the switch? I found a Youtube tutorial on loading IOS software to a switch, I wasn't sure if that would carry a base-load configuration with it.