« Volver al listado

CVE-2012-5424

Estado: ModificadaMedia (5)—

Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted password string, aka Bug ID CSCuc65634.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Secure Access Control Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-5424",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-11-07T23:55:01.320",
  "references": [
    {
      "url": "http://osvdb.org/87251",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://secunia.com/advisories/51194",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121107-acs",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/56433",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1027733",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79860",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://osvdb.org/87251",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51194",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121107-acs",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/56433",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1027733",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79860",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted password string, aka Bug ID CSCuc65634."
    },
    {
      "lang": "es",
      "value": "Cisco Secure Access Control System (ACS) v5.x antes  v5.2 Patch 11 y v5.3 antes de 5.3 Patch 7, cuando se usa una determinada configuración que implica TACACS+ y LDAP, no valida correctamente las contraseñas, lo que permite a atacantes remotos evitar la autenticación mediante el envío de un nombre de usuario válido y una contraseña modificada a mano. Se trata de un problema también conocido como Bug ID CSCuc65634.\r\n"
    }
  ],
  "lastModified": "2026-06-16T23:46:48.440",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_server:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1D9BFE6-C698-493C-98C8-9A3B2962BFB4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_server:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4095508A-D5DA-4609-82E7-8FA243F08CB6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_server:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF26A035-DBF6-4720-82D2-268EF7472F0D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_server:5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD5F16F0-84E9-471D-9004-30D3078897DA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}