DISA STIGS Viewer

Finding ID	Version	Rule ID	IA Controls	Severity
V-271972	CACI-ND-000057	SV-271972r1114185_rule		Medium

Description

Disable the USB port in those environments where physical access to the devices is not strictly controlled, or in environments where this extra layer of protection is required. Cisco Nexus 9000 switches running Cisco ACI code have the USB port enabled by default. When the USB port is enabled, switches will try to boot from the USB drive first. This may be a security risk in case a malicious actor has physical access to the switch, given they could power-cycle the device to try to boot the switch from a USB image that contains malicious code. Even if this is not a common scenario considering that most organizations have physical access security guidelines in place, Cisco ACI release 5.2(3) introduced the option to disable the USB port using a specific switch policy.

STIG	Date
Cisco ACI NDM Security Technical Implementation Guide	2025-06-13

Check Text (C-76022r1064057_chk)

Verify the USB port is disabled: 1. Navigate to Fabric >> Access Policies >> Policies >> Switch >> USB Configuration >> default. 2. Verify the "Disable USB Port" box is checked. If the USB port is not disabled, this is a finding.

Fix Text (F-75929r1114185_fix)

Disable the USB port on all switches within the Cisco ACI fabric: 1. Navigate to Fabric >> Access Policies >> Policies >> Switch >> USB Configuration >> default. 2. Check the "Disable USB Port" box; this will disable the USB port on all switches within the Cisco ACI fabric.