CVE-2014-0648

The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/102117
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32379	Vendor Advisory
http://www.securityfocus.com/bid/64962	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029634	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90431
http://osvdb.org/102117
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32379	Vendor Advisory
http://www.securityfocus.com/bid/64962	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029634	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90431

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:secure_access_control_system::::::::
	cpe:2.3:a:cisco:secure_access_control_system:5.1:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.1:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.2:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.3:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.4:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.5:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.2:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.1:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.2:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.1:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.2:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.3:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.4:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.5:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.6:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.7:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.8:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.9:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.1:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.2:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.3:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.4:::::::*
	cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.5:::::::*

History

21 Nov 2024, 02:02

Type	Values Removed	Values Added
References	~~() http://osvdb.org/102117 -~~	() http://osvdb.org/102117 -
References	~~() http://secunia.com/advisories/56213 -~~	() http://secunia.com/advisories/56213 -
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=32379 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=32379 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/64962 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/64962 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1029634 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1029634 - Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/90431 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/90431 -

Information

Published : 2014-01-16 19:55

Updated : 2024-11-21 02:02

NVD link : CVE-2014-0648

Mitre link : CVE-2014-0648

CVE.ORG link : CVE-2014-0648

JSON object : View

Products Affected

cisco

secure_access_control_system

CWE

CWE-264

Permissions, Privileges, and Access Controls

10.0 /10