CVE-2006-4982
Cisco NAC maintains an exception list that does not record device properties other than MAC address, which allows physically proximate attackers to bypass control methods and join a local network by spoofing the MAC address of a different type of…
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
Cisco NAC maintains an exception list that does not record device properties other than MAC address, which allows physically proximate attackers to bypass control methods and join a local network by spoofing the MAC address of a different type of device, as demonstrated by using the MAC address of a disconnected printer.
- CVSS 2.0
- 4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Affected
- cisco/network access control
- Source
- cve@mitre.org
References
- http://www.insightix.com/files/pdf/Bypassing_NAC_Solutions_Whitepaper.pdf
- http://www.osvdb.org/30978
- http://www.securityfocus.com/archive/1/446421/100/0/threaded
- http://www.insightix.com/files/pdf/Bypassing_NAC_Solutions_Whitepaper.pdf
- http://www.osvdb.org/30978
- http://www.securityfocus.com/archive/1/446421/100/0/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.