If you missed this Catastrophic severity 1 vulnerability, check the temporary solution below, if you do not want to upgrade your software to a not properly tested software. There are currently, at the time of writing, no software upgrade solution available to the whole 3560 series switches.

Cisco Advisory:


Cisco Bug 76186 description (requires login)


In dept description:


If you do not use Smart Install, will it prevent the vulnerability if Smart Install is disabled?

Hopefully there will be some proper software upgrades available soon.

1 Answer 1


I can hereby confirm that, disabling Smart Install will prevent this vulnerability.

Before disabling:

X@X:/mnt/c/Python$ python vstack.py -t
[*] Connecting to Smart Install Client port 4786
[*] Send a malicious packet

After this switch crashes and reloads.

Then i use no vstack in global config mode and try again:

X@X:/mnt/c/Python$ python vstack.py -t
[*] Connecting to Smart Install Client port 4786
Traceback (most recent call last):
  File "vstack.py", line 32, in <module>
    con.connect((options.target, options.port))
  File "/usr/lib/python2.7/socket.py", line 224, in meth
    return getattr(self._sock,name)(*args)
socket.error: [Errno 111] Connection refused

We've implemented no vstack on 3000 switches, since we do not use Smart Install.

  • 2
    Exactly. We have had to disable this for a while, and it pops up again every once in a while.
    – Ron Maupin
    Apr 5, 2018 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.