Cisco IOS vs IOS-XE Security: Key Differences for Your Router Audit
Cisco IOS and IOS-XE share the same CLI philosophy and most of the same security commands — but they are not identical platforms. IOS-XE has stronger password algorithms, additional API attack surfaces, and some different defaults. Knowing which platform you are auditing changes some of what you check.
Platform Overview
Cisco IOS — the original Internetwork Operating System — has been the operating system on Cisco routers since 1986. It runs on older platforms including ISR G2 (2900/3900 series), classic Catalyst switches, and many legacy devices still widely deployed in enterprise networks.
IOS-XE is the modern Cisco router operating system. It uses the same CLI as IOS but runs on a Linux kernel, with IOS functionality implemented as a daemon on top of the OS. IOS-XE runs on current-generation platforms including ISR 4000 series, ASR 1000 series, Catalyst 8000V, and CSR 1000V (cloud). If you are deploying new hardware today, you are deploying IOS-XE.
From a security audit perspective, approximately 85% of the controls you check are identical between the two platforms. The differences that matter are in password hashing strength, API management interfaces, and some default behavior changes that Cisco made when re-architecting IOS-XE.
Password Algorithm Differences
This is the most important security difference between the two platforms and affects how you should configure — and audit — passwords.
Classic IOS: Type 5 (MD5)
In classic IOS, the enable secret command uses Type 5 hashing — MD5. While significantly better than the Type 7 reversible encryption used by service password-encryption, MD5 is considered weak by modern standards. Large hashcat rigs can crack MD5 hashes at billions of attempts per second. Type 5 hashes are recognizable in the config by the $1$ prefix.
! Classic IOS — Type 5 (MD5)
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0IOS-XE: Type 8 and Type 9 Available
IOS-XE supports stronger password hashing algorithms. Type 8 uses PBKDF2-SHA256, which is significantly slower to crack than MD5. Type 9 uses scrypt, which is both memory-hard and compute-intensive — making it the strongest option currently supported in Cisco IOS-XE.
! IOS-XE — Type 9 (scrypt) — preferred
enable algorithm-type scrypt secret [passphrase]
! IOS-XE — Type 8 (PBKDF2) — also acceptable
enable algorithm-type sha256 secret [passphrase]
! Check what type is configured
show running-config | include enable secretAudit check for IOS-XE: If you see enable secret 5 $1$... in an IOS-XE config, that is a finding — the device is using MD5 when stronger algorithms are available. On IOS-XE, look for enable secret 9 $9$... (scrypt) or enable secret 8 $8$... (PBKDF2-SHA256).
Username Password Algorithms
The same distinction applies to local user accounts. On IOS-XE, you should configure local users with scrypt hashing:
! IOS-XE — strong local user password
username admin privilege 15 algorithm-type scrypt secret [passphrase]
! Classic IOS — limited to Type 5
username admin privilege 15 secret [passphrase]New Attack Surface in IOS-XE: RESTCONF and NETCONF
IOS-XE introduced support for model-driven programmability through NETCONF (port 830) and RESTCONF (HTTP/HTTPS). These APIs allow programmatic configuration and monitoring of the device. They are useful for network automation but represent attack surface that does not exist in classic IOS.
In 2023, Cisco disclosed a critical vulnerability (CVE-2023-20198) in the IOS-XE web UI that allowed unauthenticated remote code execution. Thousands of internet-exposed IOS-XE devices were compromised. The web UI uses the same HTTP server infrastructure as RESTCONF. This event demonstrated that the expanded programmability features in IOS-XE, if not properly secured, create significant risk.
Auditing API Access on IOS-XE
When auditing IOS-XE, check whether RESTCONF and NETCONF are enabled and, if so, whether they are properly secured:
! Check if RESTCONF is enabled
show running-config | include restconf
! Check if NETCONF is enabled
show running-config | include netconf
! Disable both if not needed
no restconf
no netconf-yang
! If needed, restrict with an ACL
ip http access-class [ACL-NUMBER]
restconf access-class [ACL-NUMBER]Unlike classic IOS where the HTTP server is either on or off, IOS-XE has the web UI, RESTCONF, and NETCONF as separate services that can be independently enabled. Auditing all three is necessary for complete coverage.
Security Controls That Apply to Both
The vast majority of router security controls are identical on IOS and IOS-XE. The following table shows the controls that apply to both platforms without any command differences.
| Control | Applies To |
|---|---|
| Disable Telnet, enable SSH version 2 | IOS + IOS-XE |
| AAA new-model with TACACS+/RADIUS | IOS + IOS-XE |
| Service password-encryption | IOS + IOS-XE |
| Login banner | IOS + IOS-XE |
| VTY exec-timeout | IOS + IOS-XE |
| Access-class ACL on VTY | IOS + IOS-XE |
| No CDP on external interfaces | IOS + IOS-XE |
| No ip source-route | IOS + IOS-XE |
| NTP authentication | IOS + IOS-XE |
| Logging with timestamps to syslog | IOS + IOS-XE |
| OSPF/EIGRP/BGP authentication | IOS + IOS-XE |
| Default SNMP community removal | IOS + IOS-XE |
| No ip http server | IOS + IOS-XE |
| Control Plane Policing | IOS + IOS-XE |
IOS-XE-Specific Security Controls
The following controls apply specifically to IOS-XE and should be added to your audit checklist for IOS-XE devices:
| Control | Platform | Description |
|---|---|---|
| Use Type 8 or Type 9 password hashing | IOS-XE Only | Use algorithm-type scrypt secret or algorithm-type sha256 secret for enable and user passwords |
| Disable RESTCONF if not used | IOS-XE Only | no restconf — prevents unauthorized API access |
| Disable NETCONF-YANG if not used | IOS-XE Only | no netconf-yang — removes NETCONF listener on port 830 |
| Restrict HTTP server with ACL | IOS-XE Only | ip http access-class [ACL] — applies to web UI, RESTCONF, and DNA Center connectivity |
| Review YANG data model access | IOS-XE Only | Verify no unauthorized NETCONF sessions via show netconf-yang sessions |
Audit Your IOS or IOS-XE Router
RouterAuditTool.com handles both IOS and IOS-XE configurations — paste your running config and get platform-appropriate findings instantly.
Run Free Audit →How to Identify Which Platform You Are Auditing
If you are not sure whether a configuration is from a classic IOS or an IOS-XE device, there are several ways to tell from the config text itself.
! Check the version line at the top of the config
! Classic IOS: "version 15.x" (without XE designation)
version 15.7
! IOS-XE: includes "XE" in the version string
version 17.3
! Also check: IOS-XE configs often contain:
! "platform" configuration blocks
! "restconf" or "netconf-yang" commands
! "ip http authentication local" (web UI auth)
! "crypto pki" blocks for certificate infrastructure
! Verify directly on the device:
show version | include IOSFrequently Asked Questions
enable algorithm-type scrypt secret instead of enable secret to get the strongest available hashing.no restconf. Given the 2023 IOS-XE web UI vulnerability that exploited this attack surface, reducing the programmability API footprint on devices that don’t need it is sound security practice. If you use RESTCONF for automation, ensure it is restricted with an ACL to only allow connections from known management systems.Ready to Audit Your Router?
Free. No login. No data sent to any server. Works on Cisco IOS and IOS-XE.
Run Your Free Audit Now →