VIR Vulnerability Intelligence Relay

CVE-2013-3466

critical
Published 2013-08-29 · Modified 2026-04-29
CVSS v3
—
VIR risk
9.3

Description

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Application impact
VendorProductVersionsFixed
cisco ciscosecure_access_control_server{"endIncluding":"4.2.1.15.10"}
cisco ciscosecure_access_control_server4.2.1.15.0
cisco ciscosecure_access_control_server4.2.1.15.1
cisco ciscosecure_access_control_server4.2.1.15.2
cisco ciscosecure_access_control_server4.2.1.15.3
cisco ciscosecure_access_control_server4.2.1.15.4
cisco ciscosecure_access_control_server4.2.1.15.6
cisco ciscosecure_access_control_server4.2.1.15.7
cisco ciscosecure_access_control_server4.2.1.15.8
cisco ciscosecure_access_control_server4.2.1.15.9

References

CWEs

CWE-287

💬 Discuss CVE-2013-3466 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.