Cisco's Small Business Switches: A Global DNS Disaster
On January 8, 2026, a critical issue struck, causing widespread panic among network admins. Cisco's small business switches were crashing, and the culprit? A fatal flaw in the DNS client service. But here's the kicker: it wasn't just a few isolated incidents.
These switches were entering an endless reboot cycle, causing major disruptions until their DNS configurations were stripped away. The chaos began around 2 AM UTC, targeting models like CBS250, C1200, CBS350, SG350, and SG550X series. The logs revealed a critical error: DNS_CLIENT-F-SRCADDRFAIL, failing to resolve common domains and time servers.
The DNSC task's fatal errors resulted in core dumps and resets, with firmware versions 4.1.7.17, 4.1.3.36, and 4.1.7.24 bearing the brunt. Admins scrambled to manage the chaos, with one reporting a fleet of 50 CBS250 and C1200 units crashing until DNS configurations were removed.
The Root Cause:
- Affected Models: CBS250/C1200, CBS350, SG550X
- Software Versions: 4.1.7.17, 4.1.3.36, 4.1.7.24, and more
- Date Codes: May 2024, May/Aug 2025
The crashes were linked to DNS lookups for default servers, even without explicit NTP config. A potential culprit? Cloudflare's 1.1.1.1 DNS, as secondary servers might have prevented the issue. Cisco's DNS client's lack of resilience in handling lookup failures is a key concern.
Temporary Solutions:
- Disable DNS: A quick fix but limits hostname resolution.
- Remove default SNTP: Stabilizes switches but impacts time sync.
- Block internet access: Isolates switches but may hinder management.
Cisco acknowledged the issue, confirming impacts on multiple switch lines. Yet, as of January 9, no public solution or patch has been released. This leaves small businesses vulnerable to disruptions from common DNS issues, emphasizing the need for firmware updates.
The Controversy:
The synchronized crashes hint at a global trigger, possibly external DNS changes. But was it solely Cisco's fault? Could better resilience in their DNS client have prevented this? Admins must stay vigilant, but is this issue a wake-up call for more robust firmware in embedded systems?
Stay tuned for updates, and feel free to share your thoughts below. Is Cisco's response adequate? What could have been done differently? Join the discussion!
