CVE-2008-7232 Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command.

HighCVSS 10.0 EPSS 24.5% Framework module Public exploit

Published: 2009-09-14 17:00
Updated: 2026-06-17 02:03
Exploit status: Public exploit available

Description

Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command.

Affected products

Product	Affected versions	Fixed in
netplex-tech xtacacsd	<= 4.1.2	No fix listed
netplex-tech xtacacsd	= 2.0	No fix listed
netplex-tech xtacacsd	= 3.0	No fix listed
netplex-tech xtacacsd	= 3.1	No fix listed
netplex-tech xtacacsd	= 3.2	No fix listed
netplex-tech xtacacsd	= 3.3	No fix listed
netplex-tech xtacacsd	= 3.4	No fix listed
netplex-tech xtacacsd	= 3.5	No fix listed
netplex-tech xtacacsd	= 4.0	No fix listed
netplex-tech xtacacsd	= 4.1	No fix listed
netplex-tech xtacacsd	= 4.1.1	No fix listed

References

CVSS v2.0

10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 24.51% (percentile 97.9)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

XTACACSD report() Buffer Overflow Framework module · Metasploit Framework (Rapid7) · 2008-01-08
Xtacacsd 4.1.2 - 'report()' Remote Buffer Overflow (Metasploit) Exploit · Exploit Database (OffSec) · 2008-01-08