Data from Configuration Repository: Network Device Configuration Dump
- ID
- T1602.002
- Tactics
- TA0009 Collection
- Sub-technique of
- T1602 Data from Configuration Repository
- Platforms
- Network Devices
- Data sources
- User Account Authentication, Command Execution, Network Traffic Content, Network Connection Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.[2][3] These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Detection
- DET0233 Detection Strategy for Network Device Configuration Dump via Config Repositories
Data components: User Account Authentication, Command Execution, Network Traffic Content, Network Connection Creation
Mitigations (6)
- M1030 Network Segmentation
Segregate SNMP traffic on a separate management network.[1]
- M1031 Network Intrusion Prevention
Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources. Create signatures to detect Smart Install (SMI) usage from sources other than trusted director.[2]
- M1037 Filter Network Traffic
Apply extended ACLs to block unauthorized protocols outside the trusted network.[1]
- M1041 Encrypt Sensitive Information
Configure SNMPv3 to use the highest level of security (authPriv) available.[1]
- M1051 Update Software
Keep system images and software updated and migrate to SNMPv3.[3]
- M1054 Software Configuration
Allowlist MIB objects and implement SNMP views. Disable Smart Install (SMI) if not used.[4][2]
Groups (1)
Software (1)
References
- US-CERT TA17-156A SNMP Abuse 2017
- US-CERT TA18-106A Network Infrastructure Devices 2018
- Cisco Blog Legacy Device Attacks
- Cisco Securing SNMP