Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).

From Infrastructure L3 Switch Secure Technical Implementation Guide - Cisco

Part of Disabled ports are not kept in an unused VLAN.

SV-3973r2_rule Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).

Vulnerability discussion

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

Check content

Review the device configuration to determine if all disabled ports have been placed into an unused VLAN. The VLAN must not be VLAN 1. If disabled ports are not assigned to an unused VLAN or have been placed into VLAN 1, this is a finding.

Fix text

Assign all disabled ports to an unused VLAN. Do not use VLAN1.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.