CVE-2014-0648

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/102117
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacsVendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32379Vendor Advisory
http://www.securityfocus.com/bid/64962Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029634Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90431
http://osvdb.org/102117
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacsVendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32379Vendor Advisory
http://www.securityfocus.com/bid/64962Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029634Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90431

Timeline

Published: Jan 16, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-06499.0The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which all CVE-2014-065010.0The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-CVE-2014-06514.9The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remot CVE-2014-06524.3Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbit CVE-2014-06534.3The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentica CVE-2014-06544.3Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting mess CVE-2014-06554.3The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-ca CVE-2014-06564.0Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted fie CVE-2014-06574.0The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions CVE-2014-06585.4Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul CVE-2014-065910.0The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, an CVE-2014-06607.1Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage)