CVE-2010-4675
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) do not properly determine the interfaces for which TELNET connections should be permitted, which allows remote authenticated users to bypass intended access…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) do not properly determine the interfaces for which TELNET connections should be permitted, which allows remote authenticated users to bypass intended access restrictions via vectors involving the "lowest security level interface," aka Bug ID CSCsv40504.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 2.83% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- cisco/adaptive security appliance software · cisco/5500 series adaptive security appliance · cisco/asa 5500
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/42931
- http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.pdf
- http://www.securityfocus.com/bid/45767
- http://www.securitytracker.com/id?1024963
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64601
- http://secunia.com/advisories/42931
- http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.pdf
- http://www.securityfocus.com/bid/45767
- http://www.securitytracker.com/id?1024963
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64601
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.