CVE-2014-0650 The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID....
HighCVSS 10.0
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco secure access control system | <= 5.4.0.46.2 | No fix listed |
| cisco secure access control system | = 5.1 | No fix listed |
| cisco secure access control system | = 5.1.0.44 | No fix listed |
| cisco secure access control system | = 5.1.0.44.1 | No fix listed |
| cisco secure access control system | = 5.1.0.44.2 | No fix listed |
| cisco secure access control system | = 5.1.0.44.3 | No fix listed |
| cisco secure access control system | = 5.1.0.44.4 | No fix listed |
| cisco secure access control system | = 5.1.0.44.5 | No fix listed |
| cisco secure access control system | = 5.2 | No fix listed |
| cisco secure access control system | = 5.2.0.26 | No fix listed |
| cisco secure access control system | = 5.2.0.26.1 | No fix listed |
| cisco secure access control system | = 5.2.0.26.2 | No fix listed |
| cisco secure access control system | = 5.3.0.40.1 | No fix listed |
| cisco secure access control system | = 5.3.0.40.2 | No fix listed |
| cisco secure access control system | = 5.3.0.40.3 | No fix listed |
| cisco secure access control system | = 5.3.0.40.4 | No fix listed |
| cisco secure access control system | = 5.3.0.40.5 | No fix listed |
| cisco secure access control system | = 5.3.0.40.6 | No fix listed |
| cisco secure access control system | = 5.3.0.40.7 | No fix listed |
| cisco secure access control system | = 5.3.0.40.8 | No fix listed |
| cisco secure access control system | = 5.3.0.40.9 | No fix listed |
| cisco secure access control system | = 5.4.0.46.1 | No fix listed |
References
- 102115 vdb-entry
- 56213 third-party-advisory
- 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System vendor-advisory
- tools.cisco.com vendor-advisory
- 64964 third-party-advisory vdb-entry
- 1029634 third-party-advisory vdb-entry
- cisco-acs-cve20140650-command-exec(90432) vdb-entry