Cisco IOS Software TACACS+ Authentication Bypass (cisco-sa-ios-tacacs-hdB7thJw)

#TRUSTED 4d61592f9e6a1a8dfa6b09749739957e8d88e93922381dd45b0031973a9612be3b93338690f0d1b8e0088da72a3cd93f6dacca685f90cc33d6b3ce41d79668000c95c12a5280b05e0476b032dff017252f9b87e39efb6af35c35fa3007e50fea3e29a6d182ea2d75501e71b325ab0f8d6ad3c173af6def279d831a53f32b6a28b2b93b7d48dc945d98407e01bb6a84b21040d4354141cb7a032d0d2e8ec9f6c5fe3519c34a13ff028f56e75feeab0ce187822b771b2db01d20ed6502dea7af237060145258de1a167ddde4b61eb04c941f88baa27b8d77f4252f5e0d801aae92864f74bc67ab6679fba56550e1907692cc4c2299861feaa8a76b085c5b0465e814fc71187cc28862c32091d2ae05463ff45460bd84d90d9bbb2d7a083d0da39c27787f9b903f0977826b687a07583e53dd01d38bc1b8039b2321485b48046182e9aaa4a11b06fe319f78510c98076d51cdaabc536b21680ea7ef756a67953a50bdf4220bc215a190d4985e8c007aa98d1cf2907f12e65b099c6dcdd75da033d0449781ba59994be19333db01a7a5c7eec859f8924ace4d27a4dfb1b638a6f3da0b516baad91fe967255cba2a830e4a7fec1a7cb872cc3ed0dfdd08f05b90408263f9276640e0840ceb1b4e8d2c295e04ae2e776d0ad88b92476907557b52079bd6ec4da2d5206f42178422ae7bcdba3c85e79755ba30a882071dc0b8a407a44f
#TRUST-RSA-SHA256 a7423222b8bac6038bedb98e40e48aa335479ecefa081a54b01e0cb19663e2e489b22a1f8ad55cea97cce5721860b08995c4d0f6d8a0db85b79a2dd18d7144958b79b813ded617e3400f9cb2b7047eb6e434876b5047d857c5eb3cd922e8f0b624fd13876b0e139a1825e2918d28d15c17be5eb465dd7977dfbd9b9eef847d38c0d3b3531e61fd124f762d076b5185dd62f7d07686d16f6ad65f5b05973dbb73748010177b30ce49e01e938d5b31d6a714759d4d70fd1db9ba5938203cbc4672498d974366a083c03e1bc493f6084879cd474fa045ebf55f1db47864ada9237692c47a3e01229ddb4f046609f67e5d8a8a3d45588a769ddcd20700c175f856da3f36467711e93e0976adf72e713631c76ba4c16a733a7e2e8f4d3d892b5482cae3cde6ff6cbe614592c8e99c85e751bfa8c52914aa2134382812c05bd3c6b69d6697b9cb9900324026b3539b17f63185b8c6baca04f44b602aeaca28ab701e13674b807c433982fafcf63fe02701a2d10bc098ec82fd719fedcce14d07763400eb3355f56bc56960f56973dc2bb0fbaf4ee0bee2f191958b8fef84655c40060ad46b19242626550fae8ca9a8536fea7e3a1ed72d5d0e768514c200bc4ac26f40ad9e2c9c4cc55f44af9b80ecdfcbb9976e84fb669d70db1c0b740de13bc48bd94fb82815e90f13eeee7199500d34944552d2610c25f994fa09c466bde67edbd0
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(325433);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/07");

  script_cve_id("CVE-2025-20160");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm99306");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ios-tacacs-hdB7thJw");
  script_xref(name:"IAVA", value:"2025-A-0773");

  script_name(english:"Cisco IOS Software TACACS+ Authentication Bypass (cisco-sa-ios-tacacs-hdB7thJw)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS is affected by a vulnerability.

  - A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE
    Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication.
    This vulnerability exists because the system does not properly check whether the required TACACS+ shared
    secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting
    and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting
    arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive
    information in a TACACS+ message or bypass authentication and gain access to the affected device.
    (CVE-2025-20160)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?379c51f6");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75296
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?acad5d9e");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm99306");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwm99306");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20160");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version", "Settings/ParanoidReport");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco IOS');

var version_list=make_list(
  '12.2(6)I1',
  '15.1(3)SVR1',
  '15.1(3)SVR2',
  '15.1(3)SVR3',
  '15.1(3)SVR10',
  '15.1(3)SVS',
  '15.1(3)SVS1',
  '15.1(3)SVT1',
  '15.1(3)SVT2',
  '15.1(3)SVT3',
  '15.1(3)SVT4',
  '15.1(3)SVU1',
  '15.1(3)SVU2',
  '15.1(3)SVU10',
  '15.1(3)SVU11',
  '15.1(3)SVU20',
  '15.1(3)SVU21',
  '15.1(3)SVV1',
  '15.1(3)SVV2',
  '15.1(3)SVV3',
  '15.1(3)SVV4',
  '15.1(3)SVW',
  '15.1(3)SVW1',
  '15.1(3)SVX',
  '15.1(3)SVX1',
  '15.2(4)E6',
  '15.2(4)E7',
  '15.2(4)E8',
  '15.2(4)E9',
  '15.2(4)E10',
  '15.2(4)E10a',
  '15.2(4)E10b',
  '15.2(4)E10c',
  '15.2(4)E10d',
  '15.2(4)E10e',
  '15.2(6)E1',
  '15.2(6)E1a',
  '15.2(6)E1s',
  '15.2(6)E2',
  '15.2(6)E2a',
  '15.2(6)E2b',
  '15.2(6)E3',
  '15.2(6)EB',
  '15.2(7)E',
  '15.2(7)E0a',
  '15.2(7)E0b',
  '15.2(7)E0s',
  '15.2(7)E1',
  '15.2(7)E1a',
  '15.2(7)E2',
  '15.2(7)E2a',
  '15.2(7)E2b',
  '15.2(7)E3',
  '15.2(7)E3k',
  '15.2(7)E4',
  '15.2(7)E5',
  '15.2(7)E6',
  '15.2(7)E7',
  '15.2(7)E8',
  '15.2(7)E9',
  '15.2(7)E10',
  '15.2(7)E11',
  '15.2(7)E12',
  '15.2(7a)E0b',
  '15.2(7b)E0b',
  '15.2(8)E',
  '15.2(8)E1',
  '15.2(8)E2',
  '15.2(8)E3',
  '15.2(8)E4',
  '15.2(8)E5',
  '15.2(8)E6',
  '15.2(8)E7',
  '15.5(1)SY2',
  '15.5(1)SY3',
  '15.5(1)SY4',
  '15.5(1)SY5',
  '15.5(1)SY6',
  '15.5(1)SY7',
  '15.5(1)SY8',
  '15.5(1)SY9',
  '15.5(1)SY10',
  '15.5(1)SY11',
  '15.5(1)SY12',
  '15.5(1)SY13',
  '15.5(1)SY14',
  '15.5(1)SY15',
  '15.5(3)M7',
  '15.5(3)M8',
  '15.5(3)M9',
  '15.5(3)M10',
  '15.5(3)M11',
  '15.5(3)M11a',
  '15.5(3)M11b',
  '15.5(3)S8',
  '15.5(3)S9',
  '15.5(3)S9a',
  '15.5(3)S10',
  '15.5(3)S10a',
  '15.5(3)S10b',
  '15.6(2)SP5',
  '15.6(2)SP6',
  '15.6(2)SP7',
  '15.6(2)SP8',
  '15.6(2)SP8a',
  '15.6(2)SP9',
  '15.6(3)M4',
  '15.6(3)M5',
  '15.6(3)M6',
  '15.6(3)M6a',
  '15.6(3)M6b',
  '15.6(3)M7',
  '15.6(3)M8',
  '15.6(3)M9',
  '15.7(3)M2',
  '15.7(3)M3',
  '15.7(3)M4',
  '15.7(3)M4a',
  '15.7(3)M4b',
  '15.7(3)M5',
  '15.7(3)M6',
  '15.7(3)M7',
  '15.7(3)M8',
  '15.7(3)M9',
  '15.7(3)M10',
  '15.7(3)M10a',
  '15.7(3)M10b',
  '15.8(3)M',
  '15.8(3)M0a',
  '15.8(3)M0b',
  '15.8(3)M1',
  '15.8(3)M1a',
  '15.8(3)M2',
  '15.8(3)M2a',
  '15.8(3)M3',
  '15.8(3)M3a',
  '15.8(3)M3b',
  '15.8(3)M4',
  '15.8(3)M5',
  '15.8(3)M6',
  '15.8(3)M7',
  '15.8(3)M8',
  '15.8(3)M9',
  '15.9(3)M',
  '15.9(3)M0a',
  '15.9(3)M1',
  '15.9(3)M2',
  '15.9(3)M2a',
  '15.9(3)M3',
  '15.9(3)M3a',
  '15.9(3)M3b',
  '15.9(3)M4',
  '15.9(3)M4a',
  '15.9(3)M5',
  '15.9(3)M6',
  '15.9(3)M6a',
  '15.9(3)M6b',
  '15.9(3)M7',
  '15.9(3)M7a',
  '15.9(3)M8',
  '15.9(3)M8a',
  '15.9(3)M8b',
  '15.9(3)M9',
  '15.9(3)M9a',
  '15.9(3)M10',
  '15.9(3)M11'
);

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwm99306'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);