CVE-2006-4098

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-31 · updated 2026-06-16

Description

Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet.

Affected products

Cisco Secure Access Control Server: 3.0, 3.1, 3.2, 3.2(1), 3.2(1.20), 3.2(2) (+9)

References

http://osvdb.org/36126
http://secunia.com/advisories/23629
http://securitytracker.com/id?1017475
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml
http://www.kb.cert.org/vuls/id/477164
http://www.securityfocus.com/bid/21900
http://www.vupen.com/english/advisories/2007/0068
https://exchange.xforce.ibmcloud.com/vulnerabilities/31327
http://osvdb.org/36126
http://secunia.com/advisories/23629
http://securitytracker.com/id?1017475
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml

Get alerted when CVE-2006-4098 or the next vulnerability affects your stack