Vulnerabilities > CVE-2011-0951 - Credentials Management vulnerability in Cisco Secure Access Control System
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Metasploit
| description | This module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable. |
| id | MSF:AUXILIARY/ADMIN/CISCO/CISCO_SECURE_ACS_BYPASS |
| last seen | 2020-01-22 |
| modified | 2017-07-24 |
| published | 2012-05-13 |
| references | |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb |
| title | Cisco Secure ACS Unauthorized Password Change |
References
- http://secunia.com/advisories/43924
- http://securitytracker.com/id?1025271
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b74117.shtml
- http://www.securityfocus.com/bid/47093
- http://www.vupen.com/english/advisories/2011/0821
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66471