CVE-2009-2863 — Improper Authentication in Cisco IOS

CWE-287 — Improper AuthenticationCWE-3994 documents4 sources
Severity
7.1HIGHNVD
EPSS
0.4%
top 38.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedSep 28
Latest updateMay 2

Description

Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication, or bypass the consent web page, via a crafted request, aka Bug ID CSCsy15227.

CVSS vector

AV:N/AC:M/C:C/I:N/A:NExploitability: 8.6 | Impact: 6.9

Affected Packages1 packages

▶NVDcisco/ios136 versions+135

🔴Vulnerability Details

2
GHSA
GHSA-r2mm-qr53-2j54: Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12↗2022-05-02
▶
CVEList
CVE-2009-2863: Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12↗2009-09-28
▶

📋Vendor Advisories

1
Cisco
Cisco IOS Software Authentication Proxy Vulnerability↗2009-09-23
▶
CVE-2009-2863 — Improper Authentication in Cisco IOS | cvebase