CVE-2007-0397

The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.

Score

CVSS 2.0 6.4 Medium

Status

Modified - cve@mitre.org

Published

2007-01-20

Last modified

2024-08-07

Affected products

• Adaptive Security Appliance Device Manager (Cisco)
• Security Monitoring Analysis And Response System (Cisco)

References

• http://osvdb.org/32720
• http://secunia.com/advisories/23836
• http://securitytracker.com/id?1017535
• http://securitytracker.com/id?1017536
• http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml
• http://www.securityfocus.com/bid/22111
• http://www.vupen.com/english/advisories/2007/0245
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31567