CVE-2012-5424: Input Validation

Published Nov 7, 2012

Updated

Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted password string, aka Bug ID CSCuc65634.

Affected Software

4 affected components

Cisco Secure Access Control Server=5.0

Cisco Secure Access Control Server=5.1

Cisco Secure Access Control Server=5.2

Cisco Secure Access Control Server=5.3

Event History

Nov 7, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-5424?

CVE-2012-5424 is considered a high-severity vulnerability due to its potential for unauthorized access to systems.

How do I fix CVE-2012-5424?

To mitigate CVE-2012-5424, upgrade to Cisco Secure Access Control Server version 5.2 Patch 11 or 5.3 Patch 7 or later.

What systems are affected by CVE-2012-5424?

CVE-2012-5424 affects Cisco Secure Access Control System versions 5.0, 5.1, 5.2, and 5.3.

What is the attack vector for CVE-2012-5424?

The attack vector for CVE-2012-5424 allows remote attackers to bypass authentication by exploiting password validation issues.

Can CVE-2012-5424 be exploited remotely?

Yes, CVE-2012-5424 can be exploited remotely, enabling attackers to gain unauthorized access to affected systems.