—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

TACACS+ Authentication Bypass Vulnerability in CISCO 

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Software Affected

Cisco IOS and  IOS XE Software

Overview

A vulnerability has been reported in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication.

Target Audience: 

All IT administrators and individuals responsible for maintaining and updating in Cisco IOS Software and Cisco IOS XE Software.

Risk Assessment:

High risk of data manipulation and service disruption.

Impact Assessment:

Potential impact on confidentiality, integrity, and availability of the system.

Description

This vulnerability exists due to the system does not properly check whether the required TACACS+ shared secret is configured. An attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests.

Successful exploitation of this vulnerability could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device.

Solution

Apply appropriate updates as mentioned in Cisco Advisory

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw

Vendor Information

CISCO

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw

References

CISCO

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw

CVE Name

CVE-2025-20160

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmjWmyIACgkQ3jCgcSdc

ys8wYw//czQAxrfufy+mzS8nkkAbuT3GZAjh4RFmY/cE5uFte0sG/ngE3JGJfAmH

MWTQ6cggRw6y5qBR6fEmUIlPwU0eaWXaRix0fBb4M2Eq+6ut5Q02kPKz2t9+XxpT

GY86k5D/QrQgjogPwj/MS2UcVNp0x8AUA33h9gz1bV2sj23x0alZunGSuTlf3lG3

UP7a+yFF0ZPazHPKo2G1vTqgOFkaerlfvUGyr/33NvBky4fAHIzqHI72cJ3OH9LC

LJFMQ0NkKSgRidU9ehtn5+PDvJvw8MQzB1KbbV4x9aE7yciiz749ok0uU2wgLvxf

3BlGgsBWJJYGAWvM1k9ZGu0FPQHL8R4B/27h0p/y5zP1JjjWkrcK4W36pyk3Y6+N

jzK3IJYlkROwZcmg6GG+Yj/F8hm1W/bwKlKOa4phXpzeotvuawUxzXj7I6sYVlBg

C7CgR3+BbsRiCYS471T5KCMdOeZCYJC44IKGd/522utlcdrOtnfi12DSE9aHQzlH

i+FnWsFm439yeO2SMayw/Glmt+FVvZDo2G6h2EjATGZxYpPk254+1SaAPe1XYVry

7ycKZ/Xt/q8hiR8OpdpkQ1RScj6HyItXeiOh6efzs8twh2e4JY8ZEGyFghLaATbW

/PEal+pTMMRYL4wZ2nEuuk3BRjFHff2E0I8htxWeil8nhbLUvCM=

=faj0

—–END PGP SIGNATURE—–