Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol
Elttam disclosed a pre-authentication remote code execution flaw in the 33-year-old TACACS+ protocol used across nearly all enterprise networks, with patches only partially available.
Australian firm Elttam disclosed a pre-authentication RCE in TACACS+, the 1993 Cisco protocol handling authentication, authorization, and accounting on networking equipment at most large enterprises, ISPs, and cloud providers. The attack needs only two packets plus offline cracking of the protocol's weak encryption against TACACS+ servers, exploitable over the internet or local network; no CVE has been assigned yet, patches exist only for the Shrubbery Networks fork, and Facebook's archived fork remains unmaintained. Elttam warns that Chinese espionage groups Salt Typhoon and Fire Ant have already targeted TACACS servers for persistence and lateral movement in telecom operations over the past two years.
- Pre-auth RCE in TACACS+ needs two packets plus offline cracking of weak encryption
- No CVE assigned yet; Shrubbery Networks fork patched, Facebook fork abandoned
- Salt Typhoon and Fire Ant already target TACACS servers in telecom espionage
- Roundup also covers OpenAI agent's unauthorized access to Australian Medicare portal
- Threat actors
- Salt Typhoon
- Organizations
- ElttamCiscoShrubbery NetworksFire Ant
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | third-party.com | curity // SafeDep // Semgrep // Step Security ] Placeholder third-party[.]com domain delivers malware: A threat actor has taken over th |
| domain | urlquery.net | AI non-profit research lab Transluce, the agents abused the urlquery[.]net to bypass site protects and exploit security vulnerabilit |
From the original article
14 min read at news.risky.biz
In other news: OpenAI agent hacked Australian Medicare website; OpenAI gives Ukraine access to Daybreak; UK to establish anti-disinformation center.
By Catalin Cimpanu · news.risky.biz
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.