CVE-2012-3063 Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows re...
HighCVSS 7.1
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances, and read or modify configuration settings, via a login attempt to a context, aka Bug ID CSCts30631, a different vulnerability than CVE-2012-3058.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco application control engine software | <= a4\(2.0\) | No fix listed |
| cisco application control engine software | = a1(7) | No fix listed |
| cisco application control engine software | = a1(7a) | No fix listed |
| cisco application control engine software | = a1(7b) | No fix listed |
| cisco application control engine software | = a1(8) | No fix listed |
| cisco application control engine software | = a1(8a) | No fix listed |
| cisco application control engine software | = a3(1.0) | No fix listed |
| cisco application control engine software | = a3(2.1) | No fix listed |
| cisco application control engine software | = a3(2.2) | No fix listed |
| cisco application control engine software | = a3(2.3) | No fix listed |
| cisco application control engine software | = a3(2.4) | No fix listed |
| cisco application control engine software | = a3(2.5) | No fix listed |
| cisco application control engine software | = a3(2.6) | No fix listed |
| cisco application control engine software | = a3(2.7) | No fix listed |
| cisco application control engine software | = a4(1.0) | No fix listed |
| cisco application control engine software | = a4(1.1) | No fix listed |
| cisco application control engine software | = a4(2.1) | No fix listed |
| cisco application control engine software | = a4(2.2) | No fix listed |
| cisco application control engine software | = a5(1.0) | No fix listed |
References
- 20120620 Cisco Application Control Engine Administrator IP Address Overlap Vulnerability vendor-advisory
- 1027188 vdb-entry