Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2000-0486: Cisco IOS and TACACS+ server can crash from crafted packet

CVE-2000-0486 · published 26 years ago

Summary

The TACACS+ authentication service on Cisco IOS devices can be forced to stop working if it receives a specially crafted network packet that is larger than expected. This would disrupt user login and access controls, potentially halting normal operations. Apply the latest software update from Cisco that corrects the processing of packet lengths to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	ios	All versions `cpe:2.3:o:cisco:ios::::::::`
cisco	tacacs\+	f4.0.2alpha f4.0.3alpha `cpe:2.3:a:cisco:tacacs\+:f4.0.2alpha:::::::*`

Original advisory text

Buffer overflow in Cisco TACACS+ tac_plus server allows remote attackers to cause a denial of service via a malformed packet with a long length field.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published30 May 2000

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2000-0486 · NVD

Track software like this

Free during beta