Cisco IOS and IOS XE Software TACACS+ Authentication Bypass Vulnerability

TL;DR 📌

A vulnerability in Cisco IOS and IOS XE Software could allow unauthenticated remote attackers to bypass TACACS+ authentication or view sensitive data. The highest CVSS score is 8.1, classified as High severity. Cisco has released fixes and workarounds are available.

What happened 🕵️‍♂️

A vulnerability has been identified in the TACACS+ protocol implementation within Cisco IOS and IOS XE Software. This issue arises because the software does not properly verify if the required TACACS+ shared secret is configured. As a result, an attacker could exploit this vulnerability to intercept unencrypted TACACS+ messages or impersonate the TACACS+ server, potentially allowing unauthorized access to sensitive information or bypassing authentication altogether.

Affected products 🖥️

This vulnerability affects Cisco devices running vulnerable releases of Cisco IOS and IOS XE Software that are configured to use TACACS+ but lack the necessary TACACS+ shared secret. Cisco IOS XR Software and NX-OS Software are confirmed not to be affected.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

To mitigate this vulnerability, ensure that every TACACS+ server configured on the device has a shared secret. It is essential to evaluate the applicability and effectiveness of this workaround in your environment before implementation, as it may impact network functionality or performance.

Risk in context 🎯

With a CVSS score of 8.1, this vulnerability is rated as High risk. The exposure is significant as it allows unauthenticated access, which could lead to unauthorized data access and potential lateral movement within the network. Organizations should prioritize remediation to protect sensitive information and maintain network integrity.

Fast facts ⚡

• Vulnerability: TACACS+ Authentication Bypass
• CVSS Score: 8.1 (High)
• Impact: Unauthenticated access, sensitive data exposure
• Workaround: Ensure TACACS+ shared secrets are configured
• Affected Software: Cisco IOS and IOS XE Software

For leadership 🧭

This vulnerability poses a High risk to your organization, with a CVSS score of 8.1. The primary exposure drivers include unauthenticated access and potential unauthorized data access. Immediate remediation is necessary, with a recommendation to patch within 7 days, as fixes are available. Operationally, this may require a brief maintenance window with no expected configuration drift.

Now: Assess your devices for TACACS+ configuration and shared secrets.
Next: Implement the recommended patch or workaround.
Later: Monitor for any unusual activity and review security policies related to TACACS+.