Full Report
In other news: OpenAI agent hacked Australian Medicare website; OpenAI gives Ukraine access to Daybreak; UK to establish anti-disinformation center.
Analysis Summary
# Vulnerability: Pre-Authentication Remote Code Execution in TACACS+
## CVE Details
- **CVE ID**: Not yet assigned (as of report date)
- **CVSS Score**: Not officially scored, but functionally **Critical** (Pre-auth RCE)
- **CWE**: Not specified (involves weak encryption and protocol implementation flaws)
## Affected Systems
- **Products**: Networking equipment and servers utilizing the Terminal Access Controller Access-Control System Plus (TACACS+) protocol.
- **Versions**:
- Shrubbery Networks TACACS+ (versions prior to September 2026 patches)
- Facebook fork of TACACS+ (archived/unmaintained)
- **Configurations**: Devices or central authentication servers running TACACS+ on port 49, particularly those exposed to the internet or accessible via compromised internal network segments.
## Vulnerability Description
The vulnerability stems from flaws in the 33-year-old TACACS+ protocol. It allows for a pre-authentication remote code execution (RCE) attack by exploiting the protocol's weak encryption. Attackers can crack the protocol's encryption offline to gain the necessary access to execute malicious code on the TACACS+ server. The flaw can be exploited directly against the central server or, in some cases, via intermediary edge devices.
## Exploitation
- **Status**: **Exploited in the wild.** Chinese cyber-espionage groups (Salt Typhoon and Fire Ant) have reportedly exploited TACACS+ for persistence and lateral movement in telecommunications targets.
- **Complexity**: High (requires cracking weak encryption offline and managing protocol variations).
- **Attack Vector**: Network (can be exploited over the internet or local network).
## Impact
- **Confidentiality**: Total (Access to authentication, authorization, and accounting logs).
- **Integrity**: Total (Ability to run arbitrary code on the authentication server).
- **Availability**: High (Potential for system takeover or service disruption).
## Remediation
### Patches
- **Shrubbery Networks**: Patches have been released recently. Administrators should update to the latest version immediately.
- **Facebook Fork**: No patches available; this version is archived and considered end-of-life.
### Workarounds
- **Network Segmentation**: Isolate TACACS+ traffic to dedicated management networks.
- **Access Control Lists (ACLs)**: Restrict access to port 49 to only known, trusted client IP addresses.
- **Migration**: Evaluate migrating to more modern, secure protocols (e.g., RADIUS with TLS or modern identity providers) where possible, given the age and inherent weaknesses of TACACS+.
## Detection
- **Indicators of Compromise**: Monitor for unusual two-packet authentication attempts that do not follow standard login flows.
- **Detection Methods**: Inspect network traffic on port 49 for anomalous encrypted payloads. Monitor TACACS+ server logs for unexpected process execution or unauthorized configuration changes.
## References
- **Elttam Research**: hxxps[://]www[.]elttam[.]com/blog/att-cking-tacacs-to-pwn-your-network-via-a-pre-auth-rce
- **Threat Intelligence**: hxxps[://]blog[.]talosintelligence[.]com/salt-typhoon-analysis/
- **Threat Intelligence**: hxxps[://]www[.]sygnia[.]co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/
- **Risky Business Bulletin**: hxxps[://]news[.]risky[.]biz/risky-bulletin-major-vulnerability-found-in-ancient-tacacs-networking-protocol/