VIR Vulnerability Intelligence Relay

CVE-2014-0648

critical
Published 2014-01-16 · Modified 2026-04-29
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0

Description

The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@cisco.com — http://tools.cisco.com/security/center/viewAlert.x?alertId=32379

vendor Authored 2026-05-27

Vendor advisory: psirt@cisco.com — http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs

Application impact
VendorProductVersionsFixed
ciscosecure_access_control_system{"endIncluding":"5.4.0.46.6"}
ciscosecure_access_control_system5.1
ciscosecure_access_control_system5.1.0.44
ciscosecure_access_control_system5.1.0.44.1
ciscosecure_access_control_system5.1.0.44.2
ciscosecure_access_control_system5.1.0.44.3
ciscosecure_access_control_system5.1.0.44.4
ciscosecure_access_control_system5.1.0.44.5
ciscosecure_access_control_system5.2
ciscosecure_access_control_system5.2.0.26
ciscosecure_access_control_system5.2.0.26.1
ciscosecure_access_control_system5.2.0.26.2
ciscosecure_access_control_system5.3.0.40.1
ciscosecure_access_control_system5.3.0.40.2
ciscosecure_access_control_system5.3.0.40.3
ciscosecure_access_control_system5.3.0.40.4
ciscosecure_access_control_system5.3.0.40.5
ciscosecure_access_control_system5.3.0.40.6
ciscosecure_access_control_system5.3.0.40.7
ciscosecure_access_control_system5.3.0.40.8
ciscosecure_access_control_system5.3.0.40.9
ciscosecure_access_control_system5.4.0.46.1
ciscosecure_access_control_system5.4.0.46.2
ciscosecure_access_control_system5.4.0.46.3
ciscosecure_access_control_system5.4.0.46.4
ciscosecure_access_control_system5.4.0.46.5

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.