Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2005-4499: Cisco VPN concentrators allow credential theft via RADIUS ACLs

CVE-2005-4499 · published 20 years ago

Summary

Cisco VPN 3000 series devices can create a hidden user name and password when they download access control lists from the Cisco Secure Access Control Server. An attacker who watches the network traffic can see the user name and then use the matching password to log in to other devices that rely on the same server. Update the devices or disable the downloadable ACL feature to stop the exposure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	vpn_3001_concentrator	All versions `cpe:2.3:h:cisco:vpn_3001_concentrator::::::::`
cisco	vpn_3015_concentrator	All versions `cpe:2.3:h:cisco:vpn_3015_concentrator::::::::`
cisco	vpn_3020_concentrator	All versions `cpe:2.3:h:cisco:vpn_3020_concentrator::::::::`
cisco	vpn_3030_concentator	4.7.1 4.7.1.f `cpe:2.3:h:cisco:vpn_3030_concentator::::::::`
cisco	vpn_3060_concentrator	All versions `cpe:2.3:h:cisco:vpn_3060_concentrator::::::::`
cisco	vpn_3080_concentrator	All versions `cpe:2.3:h:cisco:vpn_3080_concentrator::::::::`
cisco	adaptive_security_appliance_software	7.0 7.0\(4\) 7.0.1.4 7.0.4.3 `cpe:2.3:o:cisco:adaptive_security_appliance_software:7.0:::::::*`
cisco	vpn_3000_concentrator_series_software	2.0 2.5.2.a 2.5.2.b 2.5.2.c 2.5.2.d 2.5.2.f 3.0 3.0.3.a 3.0.3.b 3.0.4 3.1 3.1\(rel\) 29 more version ranges `cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:2.0:::::::*`
cisco	pix_firewall_software	4.3 2.7 3.0 3.1 4.0 4.1\(6\) 4.1\(6b\) 4.2 4.2\(1\) 4.2\(2\) 4.2\(5\) 4.4 45 more version ranges `cpe:2.3:o:cisco:pix_firewall_software:4.3:::::::*`
cisco	vpn_3005_concentrator_software	4.0.1 `cpe:2.3:o:cisco:vpn_3005_concentrator_software:4.0.1:::::::*`
cisco	pix_asa_ids	All versions `cpe:2.3:a:cisco:pix_asa_ids::::::::`
cisco	pix_firewall	6.2.2_.111 6.2.3_\(110\) 6.3.3_\(133\) `cpe:2.3:a:cisco:pix_firewall:6.2.2_.111:::::::*`
cisco	secure_access_control_server	2.0 2.1 2.3 2.3.5.1 2.3.6.1 2.4 2.5 2.6 2.6.2 2.6.3 2.6.4 2.42 16 more version ranges `cpe:2.3:a:cisco:secure_access_control_server::::::::`
cisco	vpn_3002_hardware_client	All versions `cpe:2.3:a:cisco:vpn_3002_hardware_client::::::::`
cisco	pix_firewall_501	All versions `cpe:2.3:h:cisco:pix_firewall_501::::::::`
cisco	pix_firewall_506	All versions `cpe:2.3:h:cisco:pix_firewall_506::::::::`
cisco	pix_firewall_515	All versions `cpe:2.3:h:cisco:pix_firewall_515::::::::`
cisco	pix_firewall_515e	All versions `cpe:2.3:h:cisco:pix_firewall_515e::::::::`
cisco	pix_firewall_520	All versions `cpe:2.3:h:cisco:pix_firewall_520::::::::`
cisco	pix_firewall_525	All versions `cpe:2.3:h:cisco:pix_firewall_525::::::::`
cisco	pix_firewall_535	All versions `cpe:2.3:h:cisco:pix_firewall_535::::::::`

Original advisory text

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges by sniffing the username from the cleartext portion of a RADIUS session, then using the password to log in to another device that uses CS ACS.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Timeline

Published22 Dec 2005

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2005-4499 · NVD

Track software like this

Free during beta