CVE-2004-1461: Cisco Secure Access Control Server

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the ACS GUI, which allows remote attackers to bypass authentication by connecting to that port from the same IP address.

Affected products

• Cisco Secure Access Control Server: version 3.0 only; version 3.1 only; version 3.2 only; version 3.2(1) only; version 3.2(2) only; version 3.2(3) only; …
• Cisco Secure ACS Solution Engine: any version

Published 2004-12-31. Last modified 2026-06-16.