Your routers have a default configuration. That configuration was designed for interoperability, not security.
CIS Cisco IOS benchmark has 87 controls. The average enterprise enforces fewer than 30.
What an unprotected management plane looks like
- TELNET STILL ENABLED Telnet transmits credentials in cleartext. Every username and password traverses the network readable by any device on the path. The fix is three lines of IOS configuration. It is still present in production networks in 2026.
transport input ssh ip ssh version 2 no service telnet
- DEFAULT SNMP COMMUNITY STRINGS "public" and "private" are still the most common SNMP community strings found during enterprise assessments. SNMPv2 with known community strings exposes your full device MIB — routing tables, interface states, ARP caches — without authentication.
- UNRESTRICTED VTY ACCESS Without an access-class on VTY lines, any IP address on the internet can attempt SSH authentication against your router. Automated credential stuffing tools probe IOS management planes continuously.
line vty 0 4 access-class MGMT-ACCESS in login local
The MGMT-ACCESS ACL permits only your jump hosts. Three lines. The internet does not get through.
- NO CONTROL PLANE POLICING Without CoPP, your router CPU processes every packet directed at it, including crafted attack traffic. A sustained low-rate flood makes the device unresponsive. BGP sessions drop. OSPF adjacencies collapse. The network destabilizes before the first alert fires.
- NO AAA WITH TACACS+ Local authentication means no centralized visibility into who logged in, what commands were run, or when. A terminated engineer's account stays active on every device they ever accessed.
TACACS+ with command authorization means every command is logged, attributed, and reviewable. Compliance evidence generated automatically.
The hardening baseline — non-negotiable
SSHv2 only, all VTY lines SNMPv3 with auth and privacy, communities removed AAA with TACACS+ primary, local fallback only CoPP policy protecting CPU from control plane abuse Access-class on every VTY and console line Logging to central syslog with timestamps and source interface NTP with authentication, consistent across all devices No CDP/LLDP on external-facing interfaces
Real consequence: In 2025, incident response at a manufacturing firm revealed an attacker had maintained persistent access to three core routers for 8 months via Telnet. The audit log showed nothing — local authentication, no AAA, syslog disabled to reduce "noise". The attacker had full visibility into routing decisions and BGP peers.
Has your organization run a CIS benchmark assessment against your router fleet? When did you last audit VTY access controls across your entire inventory?