CVE-2013-3466

CWE-287 — Improper AuthenticationCWE-78 — OS Command Injection4 documents4 sources
Severity
9.3CRITICAL
EPSS
0.7%
top 27.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Secure Access Control Server
Timeline
PublishedAug 29
Latest updateMay 17

Description

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-w8rq-f28j-855v: The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4↗2022-05-17
▶
CVEList
CVE-2013-3466: The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4↗2013-08-29
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Access Control Server Remote Command Execution Vulnerability↗2013-08-28
▶