PT-2011-2776 · Cisco · Cisco Secure Access Control System

Published 2011-04-01 · Updated 2017-08-17 · CVE-2011-0951

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System (ACS) versions 5.1 before 5.1.0.44.6 Cisco Secure Access Control System (ACS) versions 5.2 before 5.2.0.26.3

Description The web-based management interface in Cisco Secure Access Control System (ACS) allows remote attackers to change arbitrary user passwords via unspecified vectors.

Recommendations For Cisco Secure Access Control System (ACS) version 5.1, update to version 5.1.0.44.6 or later. For Cisco Secure Access Control System (ACS) version 5.2, update to version 5.2.0.26.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-0951

Affected Products

Cisco Secure Access Control System

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_secure_acs_bypass.rb · Exploit
• http://secunia.com/advisories/43924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0951 · Security Note
• http://vupen.com/english/advisories/2011/0821 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b74117.shtml · Vendor Advisory
• http://securitytracker.com/id?1025271 · Note
• http://securityfocus.com/bid/47093 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66471 · Note