VAR-201401-0355
Vulnerability from variot - Updated: 2025-04-11 22:55The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180. Cisco Secure ACS is a central management platform for Cisco network devices that controls device authentication and authorization. A remote attacker can exploit this issue to gain access to affected devices with root-level privileges. This issue is tracked by Cisco Bug ID CSCud75180. The system can respectively control network access and network device access through RADIUS and TACACS protocols. The vulnerability is caused by the program not performing authentication operations correctly
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0355",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44.1"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44.5"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44.3"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2.0.26.1"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2.0.26.2"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44.2"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2.0.26"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44.4"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.1.0.44"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.3"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.9"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.5"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.4"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.1"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.8"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.2"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.3"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.6"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.1"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.4"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.2"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.0.40.7"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.5"
},
{
"model": "secure access control system",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.0.46.6"
},
{
"model": "secure access control system software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "5.5"
},
{
"model": "secure access control system software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "5.x"
},
{
"model": "secure access control system",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "5.0-5.4"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:cisco:secure_access_control_system",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "BID",
"id": "64958"
}
],
"trust": 0.3
},
"cve": "CVE-2014-0649",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2014-0649",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-00416",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-68142",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-0649",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2014-0649",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-00416",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-349",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-68142",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "VULHUB",
"id": "VHN-68142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180. Cisco Secure ACS is a central management platform for Cisco network devices that controls device authentication and authorization. \nA remote attacker can exploit this issue to gain access to affected devices with root-level privileges. \nThis issue is tracked by Cisco Bug ID CSCud75180. The system can respectively control network access and network device access through RADIUS and TACACS protocols. The vulnerability is caused by the program not performing authentication operations correctly",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0649"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "BID",
"id": "64958"
},
{
"db": "VULHUB",
"id": "VHN-68142"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-0649",
"trust": 3.4
},
{
"db": "BID",
"id": "64958",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "56213",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1029634",
"trust": 1.1
},
{
"db": "OSVDB",
"id": "102116",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-00416",
"trust": 0.6
},
{
"db": "CISCO",
"id": "20140115 MULTIPLE VULNERABILITIES IN CISCO SECURE ACCESS CONTROL SYSTEM",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-68142",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "VULHUB",
"id": "VHN-68142"
},
{
"db": "BID",
"id": "64958"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"id": "VAR-201401-0355",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "VULHUB",
"id": "VHN-68142"
}
],
"trust": 1.11405407
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
}
]
},
"last_update_date": "2025-04-11T22:55:48.947000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "32120",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32120"
},
{
"title": "cisco-sa-20140115-csacs",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs"
},
{
"title": "32378",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32378"
},
{
"title": "cisco-sa-20140115-csacs",
"trust": 0.8,
"url": "http://www.cisco.com/cisco/web/support/JP/112/1121/1121707_cisco-sa-20140115-csacs-j.html"
},
{
"title": "Patch for the Cisco Secure Access Control System RMI Interface Remote Elevation of Privilege Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/42559"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140115-csacs"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/56213"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/64958"
},
{
"trust": 1.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=32378"
},
{
"trust": 1.1,
"url": "http://osvdb.org/102116"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1029634"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90430"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0649"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0649"
},
{
"trust": 0.6,
"url": "https://tools.cisco.com/bugsearch/bug/cscud75180"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "VULHUB",
"id": "VHN-68142"
},
{
"db": "BID",
"id": "64958"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"db": "VULHUB",
"id": "VHN-68142"
},
{
"db": "BID",
"id": "64958"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"date": "2014-01-16T00:00:00",
"db": "VULHUB",
"id": "VHN-68142"
},
{
"date": "2014-01-15T00:00:00",
"db": "BID",
"id": "64958"
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"date": "2014-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"date": "2014-01-16T19:55:04.670000",
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00416"
},
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-68142"
},
{
"date": "2014-01-15T00:00:00",
"db": "BID",
"id": "64958"
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001190"
},
{
"date": "2014-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-349"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2014-0649"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Secure Access Control System of RMI In the interface superadmin Vulnerabilities that gain access to",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001190"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-349"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…