Infrastructure Briefing — February 5, 2020

Executive briefing: Cisco published advisory cisco-sa-tam-20200205 on 5 February 2020, detailing Trust Anchor module vulnerabilities (CVE-2019-1649, CVE-2019-1862) that allow bypass of secure boot protections and tampering with the device trust chain on certain IOS XE routers and switches.

Why it matters: Exploitation undermines platform integrity controls that protect against persistent implants, leaving edge and core infrastructure exposed to long-term compromise. Remediation often requires both software updates and ROMMON or field-replaceable hardware.

• Identify impacted hardware: Cross-check hardware inventories against affected product tables in the advisory, prioritizing ASR, Catalyst, and ISR platforms running IOS XE.
• Plan maintenance windows: Schedule ROMMON and software upgrades to the fixed releases Cisco provides; ensure out-of-band management access for recovery.
• Consider hardware replacement: Where patches are unavailable, coordinate with Cisco TAC for hardware refresh options to restore trusted boot capabilities.
• Validate trust state: After updates, verify secure boot status and run integrity checks (e.g., secure boot verify) to confirm the Trust Anchor module is enforcing policy.