Cisco Secure Access Control System vulnerabilities

35 CVEs affecting Cisco Secure Access Control System, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-0253, published 2018-05-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-0147: Cisco Secure Access Control System Java Deserialization Vulnerability, published 2018-03-08. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 18.2% chance of exploitation in the next 30 days. A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on…
CVE-2011-0951, published 2011-04-04. Medium severity, CVSS 5.0. EPSS: 14.6% chance of exploitation in the next 30 days. The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via…
CVE-2018-0253, published 2018-05-02. Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days. A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands…
CVE-2014-0648, published 2014-01-16. High severity, CVSS 10.0. EPSS: 5.9% chance of exploitation in the next 30 days. The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain…
CVE-2014-2130, published 2015-03-06. Medium severity, CVSS 6.5. EPSS: 4% chance of exploitation in the next 30 days. Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and…
CVE-2014-0650, published 2014-01-16. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID…
CVE-2014-0649, published 2014-01-16. High severity, CVSS 9.0. EPSS: 2.6% chance of exploitation in the next 30 days. The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access…
CVE-2017-3841, published 2017-02-22. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854.…
CVE-2017-12354, published 2017-11-30. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The…
CVE-2015-4219, published 2015-06-24. Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days. Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows…

Latest

CVE-2017-6769, published 2017-08-07. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS)…
CVE-2017-3840, published 2017-02-22. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect…
CVE-2017-3839, published 2017-02-22. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to have read access to part of the…
CVE-2017-3838, published 2017-02-22. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against the user of the web…
CVE-2015-0728, published 2015-05-15. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002.