The split that matters in the password section is one-way versus two-way, because it decides what a copy of a running config is worth to whoever ends up holding it. One-way passwords authenticate and authorize a local user and never have to be recovered, so a hash is enough [5]. Two-way key strings have to be recoverable by the device, because the far-end peer must reverse the same key to authenticate the session [6]. Cisco's own list of those covers TACACS+ and RADIUS server keys, MACsec, BGP, OSPF, ISIS, LDP, IKE pre-shared keys and NTP, then adds "and others" [7]. Count the named ones and you get nine credential classes that sit in the config as something reversible by design [13].
The legacy formats belong at the top of any audit, not buried as a line item. Type 7 is an alphabetical substitution cipher with a hardcoded key, and Cisco says it is easily reversed using widely available online tools [8]. Older software applied Type 0, Type 5 and Type 7 to the two-way case as well as the one-way case [9], so on any device never rebaselined since then, the config file is a plaintext keyring for anyone who can read a config archive or a support-case attachment.
The guide keeps one deliberate exception to central AAA. Steady-state authentication and authorization belong to a TACACS+ or RADIUS server, but a password local to the network element is required for the situation where those services fail [10]. That is the account that still works during an AAA outage, which is also the reason it tends to outlive rotation schedules. Its stored format is the first thing a baseline should read back.
Where Type 10 is not available on a platform, Type 8, SHA-256 with PBKDF2, is the sanctioned alternative [5]. A mixed-release estate can therefore finish with two acceptable one-way formats in the same standard, which is a documentation problem rather than a security one, provided nothing falls back further than Type 8.
The data plane list is worth reading as a separate pass. IP source routing, IP directed broadcast, ICMP redirects, ICMP unreachables and proxy ARP are forwarding behaviours on traffic that is never destined to the router [4], so they sit apart from device-reachability controls, on a separate track from the AAA and password work on the management and control planes [2][3].
This is a hardening item, addressed through guidance rather than a fixed vulnerability, with no CVE and no patch clock attached. The measurable quantity is how many routers in the estate still print Type 7 strings when someone runs show running-config, and that count is available today.
