CVEvulnerability

CVE-2015-0607

4.3 MEDIUM Published 2015-03-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-03-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-287

Description

The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.

Affected configurations

• cisco ios 15.4\(1\)t • cisco ios 15.4\(1\)t1 • cisco ios 15.4\(1\)t2 • cisco ios 15.4\(1\)t3 • cisco ios 15.4\(1\)t4 • cisco ios 15.4\(2\)t • cisco ios 15.4\(2\)t1 • cisco ios 15.4\(2\)t2 • cisco ios 15.4\(2\)t3 • cisco ios 15.4\(100\)t • cisco ios 15.4t

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References