SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2006-4430

The Cisco Network Admission Control (NAC) 3.6.4.1 and earlier allows remote attackers to prevent installation of the Cisco Clean Access (CCA) Agent and bypass local and remote protection mechanisms by modifying (1) the HTTP User-Agent header or (2) the…

MEDIUM 5.0EPSS 1.92%

Does this matter?

Lower severity and a low EPSS score (1.92%). Track it; it rarely justifies an emergency change on its own.

Description

The Cisco Network Admission Control (NAC) 3.6.4.1 and earlier allows remote attackers to prevent installation of the Cisco Clean Access (CCA) Agent and bypass local and remote protection mechanisms by modifying (1) the HTTP User-Agent header or (2) the behavior of the TCP/IP stack. NOTE: the vendor has disputed the severity of this issue, stating that users cannot bypass authentication mechanisms.

CVSS 2.0
5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
1.92% probability · 79th percentile
CISA KEV
Not listed
Affected
cisco/network admission control · cisco/network admission control manager and server system software
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.