CVE-2014-0649 The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access v...
HighCVSS 9.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco secure access control system | <= 5.4.0.46.6 | No fix listed |
| cisco secure access control system | = 5.1 | No fix listed |
| cisco secure access control system | = 5.1.0.44 | No fix listed |
| cisco secure access control system | = 5.1.0.44.1 | No fix listed |
| cisco secure access control system | = 5.1.0.44.2 | No fix listed |
| cisco secure access control system | = 5.1.0.44.3 | No fix listed |
| cisco secure access control system | = 5.1.0.44.4 | No fix listed |
| cisco secure access control system | = 5.1.0.44.5 | No fix listed |
| cisco secure access control system | = 5.2 | No fix listed |
| cisco secure access control system | = 5.2.0.26 | No fix listed |
| cisco secure access control system | = 5.2.0.26.1 | No fix listed |
| cisco secure access control system | = 5.2.0.26.2 | No fix listed |
| cisco secure access control system | = 5.3.0.40.1 | No fix listed |
| cisco secure access control system | = 5.3.0.40.2 | No fix listed |
| cisco secure access control system | = 5.3.0.40.3 | No fix listed |
| cisco secure access control system | = 5.3.0.40.4 | No fix listed |
| cisco secure access control system | = 5.3.0.40.5 | No fix listed |
| cisco secure access control system | = 5.3.0.40.6 | No fix listed |
| cisco secure access control system | = 5.3.0.40.7 | No fix listed |
| cisco secure access control system | = 5.3.0.40.8 | No fix listed |
| cisco secure access control system | = 5.3.0.40.9 | No fix listed |
| cisco secure access control system | = 5.4.0.46.1 | No fix listed |
| cisco secure access control system | = 5.4.0.46.2 | No fix listed |
| cisco secure access control system | = 5.4.0.46.3 | No fix listed |
| cisco secure access control system | = 5.4.0.46.4 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco secure access control system | = 5.4.0.46.5 | No fix listed |
References
- 102116 vdb-entry
- 56213 third-party-advisory
- 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System vendor-advisory
- tools.cisco.com vendor-advisory
- 64958 third-party-advisory vdb-entry
- 1029634 third-party-advisory vdb-entry
- cisco-acs-cve20140649-priv-esc(90430) vdb-entry