9.3

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Secure Access Control Server Version <= 4.2.1.15.10
Cisco ≫ Secure Access Control Server Version4.2.1.15.0
Cisco ≫ Secure Access Control Server Version4.2.1.15.1
Cisco ≫ Secure Access Control Server Version4.2.1.15.2
Cisco ≫ Secure Access Control Server Version4.2.1.15.3
Cisco ≫ Secure Access Control Server Version4.2.1.15.4
Cisco ≫ Secure Access Control Server Version4.2.1.15.6
Cisco ≫ Secure Access Control Server Version4.2.1.15.7
Cisco ≫ Secure Access Control Server Version4.2.1.15.8
Cisco ≫ Secure Access Control Server Version4.2.1.15.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.72% 0.702
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://www.securitytracker.com/id/1028958
Third Party Advisory
VDB Entry