CVE-2014-0650

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-16 · updated 2026-06-17
Weakness: CWE-20

Description

The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.

Affected products

Cisco Secure Access Control System: through 5.4.0.46.2; 5.1, 5.1.0.44, 5.1.0.44.1, 5.1.0.44.2, 5.1.0.44.3, 5.1.0.44.4 (+15)

References

http://osvdb.org/102115
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs
http://tools.cisco.com/security/center/viewAlert.x?alertId=32380
http://www.securityfocus.com/bid/64964
http://www.securitytracker.com/id/1029634
https://exchange.xforce.ibmcloud.com/vulnerabilities/90432
http://osvdb.org/102115
http://secunia.com/advisories/56213
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs
http://tools.cisco.com/security/center/viewAlert.x?alertId=32380
http://www.securityfocus.com/bid/64964

Get alerted when CVE-2014-0650 or the next vulnerability affects your stack