RADIUS Authentication Vulnerability in Cisco Policy Suite

CVE-2018-0134

Summary

A vulnerability exists within the RADIUS authentication module of the Cisco Policy Suite, allowing an unauthenticated remote attacker to ascertain whether a subscriber username is valid. This issue arises due to the RADIUS server component returning distinct authentication failure messages based on the validity of usernames. Consequently, an attacker could leverage these messages to identify valid usernames, potentially facilitating further attacks against the system. For more in-depth information, refer to Cisco security advisories and relevant vulnerability databases.

References