CVE-2004-1099

5 documents5 sources
Severity
10.0CRITICAL
EPSS
2.2%
top 15.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Secure Access Control Server
Timeline
PublishedJan 10
Latest updateApr 29

Description

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and gain unauthorized access via a "cryptographically correct" certificate with valid fields such as the username.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDcisco/secure_access_control_server3.3.1, 3.3\(1\)+1

Patches

Patch: www.ciac.org ↗Patch: www.securityfocus.com ↗Patch: www.ciac.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jx47-vcqg-x34g: Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3↗2022-04-29
▶
CVEList
CVE-2004-1099: Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3↗2004-12-01
▶

💥Exploits & PoCs

1
Exploit-DB
WebTrends Reporting Center 6.1 Management Interface - Full Path Disclosure↗2004-01-20
▶

📋Vendor Advisories

1
Cisco
Vulnerability in Cisco Secure Access Control Server EAP-TLS Authentication↗2004-11-02
▶
CVE-2004-1099 (CRITICAL CVSS 10) | Cisco Secure Access Control Server | cvebase.io