Downgrade System Image (T1601.002) is a sub-technique of Modify System Image, in the Defense Impairment tactic, for the Network Devices platform. The adversary installs an older version of the device operating system to weaken security.
It is a quiet technique because nothing needs to be exploited. The file is real. It is just old.
How attackers use it
MITRE says older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer or less updated defensive features.
On embedded devices, downgrading typically only requires replacing the OS file in storage. With most devices that means downloading a copy of the desired version and reconfiguring the device to boot from that file on its next restart. The adversary can then restart the device to apply the change immediately, or wait for the next restart.
The result may help them evade defenses by enabling behaviors such as Weaken Encryption. A downgrade can be done alone or together with Patch System Image.
How to detect it
MITRE's detection strategy points at:
- Anomalous file transfers of OS image files by TFTP, FTP or SCP.
- Configuration changes that point boot system variables to older image files.
- Unexpected OS version strings after a reboot.
- Checksum mismatches against approved baseline images.
A suspicious chain is transfer of an older image, change to boot configuration, then reboot or reload.
MITRE adds a caution: adversaries may tamper with CLI output to disguise a downgrade, so you need independent validation of OS version and integrity. In other words, do not rely only on the device telling you what it runs.
How to reduce the risk
MITRE lists: multi-factor authentication for user and privileged accounts (TACACS+ or RADIUS where supported), code signing so signed vendor images are validated, encrypted local credentials where available, restricted administrator accounts with no credential overlap between network and non-network platforms, and NIST-based password policies.
Add a policy that your approved image list has a minimum version, and alert if a device reports anything below it.
Check your own environment
On a Cisco IOS or IOS XE device (read-only; confirm syntax for your platform):
show version
show boot
Compare the version with your minimum approved version, and check the boot variable points at the file you expect.
Quick check
Why can the device's own version output be insufficient evidence?
Adversaries may tamper with CLI output to disguise a downgrade, so independent validation of version and integrity is needed.
