CVE-2002-0159: cisco secure_access_control_server

Vulnerability summary

CVE-2002-0159 is a high (CVSS 7.5) vulnerability in cisco secure_access_control_server. EPSS estimates a 5.44% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities.

Timeline

1. 25-06-2002
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002.

• CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.