cisco Cisco CIS Vulnerability Reference

1.1.1 AAA Rules

• 1.1.1.1-4 AAA service not enabled, AAA not required for login/enable-mode/console+VTY lines — without AAA, the device falls back to weaker line-password-only authentication with no per-user accountability. (Packet Tracer note: local username/login local is a reasonable substitute when full AAA/RADIUS isn't in the topology.)

1.1.2 Access Rules

• 1.1.2.1 Local users configured with encrypted (not cleartext) passwords
• 1.1.2.2/1.1.2.3 SSH required for remote access, VTY transport restricted to SSH (not Telnet) — this is the single most commonly-scored networking item and matches what's already in the master checklist
• 1.1.2.4 Login session timeout configured (exec-timeout) — an unattended, never-timing-out privileged session is a walk-up vulnerability
• 1.1.2.5 Auxiliary port disabled/no exec — a forgotten backdoor console path
• 1.1.2.6/1.1.2.7 SSH access control and VTY ACL restrict which hosts can even attempt to connect, on top of requiring SSH

1.1.3 Banner Rules

• 1.1.3.1-3 EXEC banner, login banner, and MOTD banner all configured — a missing legal-notice banner is an easy, guaranteed-visible fix

1.1.4 Password Rules

• 1.1.4.1 enable secret (hashed) configured — not just enable password (reversible/weak) — matches the "always prefer secret" guidance already in the master checklist
• 1.1.4.2/1.1.4.3 Line and user passwords encrypted
• 1.1.4.4 service password-encryption enabled globally

1.1.5 SNMP Rules (only applicable if the topology actually has SNMP configured)

• 1.1.5.1/1.1.5.2 Default community strings private/public forbidden — using the factory-default community string is equivalent to leaving a default password in place
• 1.1.5.3/1.1.5.4 SNMP read+write or write-only access forbidden unless explicitly required
• 1.1.5.5/1.1.5.6 SNMP always restricted by an ACL — SNMP with no ACL means anyone on the network segment can query (or worse, write to) the device
• 1.1.5.7 Community strings authorized and access-controlled

1.2.1 Clock Rules

• 1.2.1.1/1.2.1.2 Clock timezone set to UTC (consistent log timestamps), summer-time/DST clock adjustment disabled (prevents an hour-long log-correlation gap twice a year)

1.2.2 Global Service Rules

• 1.2.2.1 CDP disabled globally unless specifically needed — leaks device model, IOS version, and IP addressing to anyone on the segment. Matches the master checklist's CDP guidance.
• 1.2.2.2-1.2.2.11 Finger service, IP BOOTP server, Identification (ident) service, IP HTTP server, remote startup-config loading, TCP/UDP small-servers, and TFTP server all forbidden unless required — this is a comprehensive "disable unused legacy services" list; the master checklist covers HTTP server and small-servers but double-check Finger, BOOTP, and remote-config-loading are also addressed
• 1.2.2.7/1.2.2.8 TCP keepalives-in/out required (not forbidden) — these actually should be enabled, since they help the device detect and clean up dead/hung TCP sessions (a minor DoS-resilience measure)

1.2.3 Logging Rules

• 1.2.3.1-1.2.3.7 Logging enabled, buffered logging configured, logging to console, logging to a syslog server, trap severity level set appropriately, timestamps enabled on both debug and log messages — without timestamps, log entries are nearly useless for reconstructing an incident timeline

1.2.4 NTP Rules

• 1.2.4.1-1.2.4.3 Primary/secondary/tertiary NTP servers configured — accurate time is a prerequisite for meaningful logging and for any certificate/Kerberos-style time-sensitive auth elsewhere in the topology

1.3.1 Routing Rules

• 1.3.1.1 Directed broadcast forbidden — directed broadcasts are a classic amplification/smurf-attack vector
• 1.3.1.2 IP source-route forbidden — source routing lets a packet dictate its own path, bypassing normal routing/firewall logic; already covered in the master checklist (no ip source-route)

• 2.1.1.1/2.1.1.2 AAA authentication required for both enable and login (stricter enforcement than Level 1's baseline requirement)
• 2.1.1.3-2.1.1.7 AAA accounting for commands, connections, exec sessions, network access, and system events — this is what actually produces an audit trail of who did what, beyond just who logged in

• 2.2.1.1-2.2.1.5 A dedicated loopback interface configured, with AAA/NTP/TFTP services bound to it specifically (rather than any-interface) — this is real-IOS best practice for management-plane isolation; often not practical/checkable in Packet Tracer depending on the topology
• Multiple loopback interfaces forbidden (keeps the management-plane binding unambiguous)

2.3.1 Border Router Filtering (only applicable if the topology has an external/internet-facing edge router)

• Private (RFC1918) source addresses forbidden from external networks, external source addresses forbidden on outbound traffic — classic anti-spoofing/BCP38 ingress-egress filtering

2.3.2 Neighbor (Routing Protocol) Authentication (only applicable if the topology actually runs a routing protocol)

• BGP/EIGRP/OSPF/RIPv2 authentication required if that protocol is in use — an unauthenticated routing protocol lets any device on the segment inject bogus routes. The master checklist's OSPF MD5 example is exactly this control; the same logic extends to whichever protocol the topology actually uses.

2.3.3 Routing Rules

• Unicast Reverse-Path Forwarding (uRPF) required — drops packets with spoofed source addresses that couldn't have legitimately arrived on that interface
• IP Proxy ARP forbidden — proxy ARP lets a router answer ARP requests on behalf of other hosts, which can be abused to intercept traffic between hosts that think they're on the same segment
• Tunnel interfaces forbidden unless explicitly required — an unexpected GRE/other tunnel interface is a potential covert channel or misconfiguration