CVE-2013-3466

Published: Aug 29, 2013Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.

Affected (10)

Products: Cisco: Secure Access Control Server

Cisco

1 product

Secure Access Control Server

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Cisco Secure Access Control Server	Up to 4.2.1.15.10
Cisco Secure Access Control Server	Version 4.2.1.15.0
Cisco Secure Access Control Server	Version 4.2.1.15.1
Cisco Secure Access Control Server	Version 4.2.1.15.2
Cisco Secure Access Control Server	Version 4.2.1.15.3
Cisco Secure Access Control Server	Version 4.2.1.15.4
Cisco Secure Access Control Server	Version 4.2.1.15.6
Cisco Secure Access Control Server	Version 4.2.1.15.7
Cisco Secure Access Control Server	Version 4.2.1.15.8
Cisco Secure Access Control Server	Version 4.2.1.15.9