By default, all Cisco Routers and Switches allow the user to recover the password and configuration, this poses an obvious security risk that could be exploited by a malicious user.

However this can be mitigated with the below command as it disables the password recovery option.

Router(config)# no service password-recovery

WARNING:

Executing this command will disable password recovery mechanism.

Do not execute this command without another plan for

password recovery.

Are you sure you want to continue? [yes/no]: y

Router(config)#

After enabling this command even if the malicious user were to have physical access to the network equipment, they would not be able to progress any further.