Internet-Security raven logo internet-security.com

TCP 4786

ProtocolTCP
Port4786
Labels

Synopsis

  • TCP port 4786 is used by Cisco Smart Install (SMI), a zero‑touch provisioning protocol in Cisco IOS/IOS XE.
  • It’s commonly present on Cisco Catalyst switches such as 2960/2960-X, 3650/3850, 4500-X, and 6800 series, which act as Smart Install clients.
  • A Smart Install Director—often a distribution switch or Cisco Prime Infrastructure—connects on TCP/4786 to push IOS images and startup configurations to new or reset switches.
  • The port is widely targeted: unauthenticated SMI functions and CVE-2018-0171 enabled attackers to download/alter configs and achieve remote code execution on vulnerable Cisco devices.
  • Real-world abuse includes mass internet scans for 4786 and tooling such as Metasploit’s auxiliary/admin/cisco/smart_install module and Nmap’s cisco-smi NSE script.

Observed activity

Last 30 days Detailed chart

More information