CVE-2015-0607

Published: Mar 6, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.

Affected (11)

Products: Cisco: Ios

Cisco

1 product

Ios

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Cisco Ios	Version 15.4(100)t
Cisco Ios	Version 15.4(1)t1
Cisco Ios	Version 15.4(1)t2
Cisco Ios	Version 15.4(1)t3
Cisco Ios	Version 15.4(1)t4
Cisco Ios	Version 15.4(1)t
Cisco Ios	Version 15.4(2)t1
Cisco Ios	Version 15.4(2)t2
Cisco Ios	Version 15.4(2)t3
Cisco Ios	Version 15.4(2)t
Cisco Ios	Version 15.4t