CVE-2009-2862

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/58338Broken Link
http://tools.cisco.com/security/center/viewAlert.x?alertId=18876Vendor Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtmlVendor Advisory
http://www.securityfocus.com/bid/36495Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022933Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/2759Permissions Required
http://osvdb.org/58338Broken Link
http://tools.cisco.com/security/center/viewAlert.x?alertId=18876Vendor Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtmlVendor Advisory
http://www.securityfocus.com/bid/36495Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022933Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/2759Permissions Required

Timeline

Published: Sep 28, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-28637.1Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication,CVE-2009-28647.8Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.CVE-2009-28657.6Buffer overflow in the login implementation in the Extension Mobility feature in the Unified Communications Manager Express (CME) component CVE-2009-28667.8Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted CVE-2009-28677.8Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP In CVE-2009-28687.8Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers CVE-2009-28697.8Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to caus CVE-2009-28707.8Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the Cisco Unified Border Element feature is enabled, allows remote attackers CVE-2009-28717.8Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote CVE-2009-28726.8Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a CVE-2009-28737.1Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a CVE-2009-28747.8The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of s