The Configuration auto-loading feature must be disabled when connected to an operational network.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3080	NET0760	SV-3080r4_rule		Medium

Description
Devices can find their startup configuration either in their own NVRAM or access it over the network via TFTP or Remote Copy (rcp). Loading the image from the network is taking a security risk since the image could be intercepted by an attacker who could corrupt the image resulting in a denial of service. Configuration auto-loading can be enabled when the device is connected to a non-operational network. Once the device is connected to an operational (i.e. production) network, configuration auto-loading must be disabled.

Description

Devices can find their startup configuration either in their own NVRAM or access it over the network via TFTP or Remote Copy (rcp). Loading the image from the network is taking a security risk since the image could be intercepted by an attacker who could corrupt the image resulting in a denial of service. Configuration auto-loading can be enabled when the device is connected to a non-operational network. Once the device is connected to an operational (i.e. production) network, configuration auto-loading must be disabled.

STIG	Date
Infrastructure Router Security Technical Implementation Guide Cisco	2018-03-06

Details

Check Text ( C-3574r8_chk )
Review the device configuration to determine if the configuration auto-loading feature is disabled. If the configuration auto-loading feature is enabled when the device is connected to an operational network, this is a finding.

Fix Text (F-3105r6_fix)
Disable the configuration auto-loading feature, when connected to an operational network.