CVE-2005-4499
No fix known EPSS 3%
The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges by sniffing the username from the cleartext portion of a RADIUS session, then using the password to log in to another device that uses CS ACS.
Products: cisco adaptive_security_appliance_software, cisco vpn_3000_concentrator_series_software, cisco vpn_3005_concentrator_software, cisco vpn_3030_concentator, cisco pix_asa_ids, cisco pix_firewall, cisco secure_access_control_server, cisco vpn_3002_hardware_client, cisco pix_firewall_software