I have no information about Cisco in particular, but a very common tactic to ensure the device is genuine is with some sort of security chip. The security chip

I have no information about Cisco in particular, but a very common tactic to ensure the device is genuine is with some sort of security chip. The security chip has a private key embedded in it in such a way that private key can be used to sign stuff, but cannot be extracted directly. The (publically downloadable) software contains matching public key, and on boot, verifies that the known public key matches the private key embedded in security chip. Even if counterfeiters can buy the same kind of security chip, they'd have no private key to program there. And this means counterfeit devices would be detected on boot. To prevent the software check from being disabled altogether, the vendor adds Secure Boot which is supposed to detect software tampering. But as this article shows, it can be bypassed as well.