Cisco IOS XE Software TACACS+ Authentication Bypass (cisco-sa-ios-tacacs-hdB7thJw)

#TRUSTED 71bb6f6d500fc9360bef90451d2b8e72a6c0547162d74a346dd612aeb202f55c633833e5bc41559c05525f9b9580681d0d2e21d6ba387a896ab6787d533bef0cfdc6f98004cd8c9a33e334606aa261e1d3ab8054d13fe1221328daeb316902aa1ca57b60e4b6ff1e1f4ec6927cd08c2cf9ff5985a98fb7d58f6100a18d64ce5a4725387a0fcf2ddbd2d609515e066f27b069e7dc188ddbf20dd28b274d6c9d52d122051a7631546ce5150e7e78693ad5bfa17c7fc2268ce31855acc9695ec5828dfab2403517d14b16f23e0021db22ebd5530a902205571849f7f811db059bd3c8b5b2fe671af1f15ccf799ea5d178d076d69721ba52be37bea0a6552d247343ca002c5afa02666429db57381b48860bc8758c84660995bafecfdb246c582920df346677b11d6fefde16d0d5312042b312d6b876c0bbd6799c17069e7a0e3b38ee7524c71cb0377bfaafdf3524259e6599f2cd6a27bca22a5173d31bec12152e6cff01503e2e1809ec418f70c0a633cb35691bc18e87bbc826a4645c9f38f71753cc4259d843348e7c85ddb3634561111b807a58b671698fd69737e7712b4428361c2b0e84231d69b19cdfba1a7a25ecf4e67d727bc31a3b5c48d15cedd1fac3299fd47137bef7ba4d112f481a456877401d0f542a66751b206249e84948fe0556c3f55ff9f6824034b1a608979311a851fbf862e654dc2b4d9da8587d25aad0
#TRUST-RSA-SHA256 68cdf8dd287b9375b821fb34b1a66fe2c02b851458e486c154ba0f19e3966d7d78ec75dc2eae70c68ee29ace8bef3e9409bcb5370bf7682c4e73e599c3f6fd90330027deb577d15472a46e76af9f9fc3e253ecbcc0f2b4957974fadb737ffecdb636dafb7bf95bed662ce594f3d3215be9cd91966e3f74ee343759c9163984b89e3147461577cc642652ec28749de8474e9d411dc351ab9db330b270906c0608e6e7438df59ffbea7e3b7657495918a707a29545f97c35afa7da8c4a2cd6922351da41a82cc92e211a13cfb2fb40da61060838deae0a890324d0bc0bd378f8cf987f121ec0c3fb44b68479a32287218ed26a239d8b29cf7ac897745693720e2ca017d75ddac551267fc2c41a70da43a896ec395cc78488d62c1fe14cc24b3b34bbdbbf9f9cf5d6db881662e2414dd6c9b17a90bfd1d472b35f6dbeaf9bc2f45e3e013e9c1a31f155e09be1a620a6154ea0c58e9dd8d3f6f5f0aa0ddebe0066c0c049226fe9f6fc01f44441481ac7bce5956340f1fac9c24265b559f253025cd6cebdf4be24da5232b034ea3b14cbc038b7d10ad4d5c77f28919fa9fcab1a5ae988954df6d0fdb3e13b150ffa71f0eb370ec184465d2bea782a63b405397cef1d86a347a424dac09691adc19950c009451a0fb1b66d4b6875d0e9552c7631b45a6208cc3336ce149350b9c71d1a08bec5cde815bdb7ac728cbedc4f13e713a060
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(325434);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/07");

  script_cve_id("CVE-2025-20160");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm99306");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ios-tacacs-hdB7thJw");
  script_xref(name:"IAVA", value:"2025-A-0773");

  script_name(english:"Cisco IOS XE Software TACACS+ Authentication Bypass (cisco-sa-ios-tacacs-hdB7thJw)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.

  - A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE
    Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication.
    This vulnerability exists because the system does not properly check whether the required TACACS+ shared
    secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting
    and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting
    arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive
    information in a TACACS+ message or bypass authentication and gain access to the affected device.
    (CVE-2025-20160)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?379c51f6");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75296
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?acad5d9e");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm99306");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwm99306");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20160");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version", "Settings/ParanoidReport");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list=make_list(
  '3.8.6E',
  '3.8.7E',
  '3.8.8E',
  '3.8.9E',
  '3.8.10E',
  '3.8.10cE',
  '3.8.10dE',
  '3.10.1E',
  '3.10.1aE',
  '3.10.1sE',
  '3.10.2E',
  '3.10.3E',
  '3.11.0E',
  '3.11.1E',
  '3.11.1aE',
  '3.11.2E',
  '3.11.2aE',
  '3.11.3E',
  '3.11.3aE',
  '3.11.4E',
  '3.11.5E',
  '3.11.6E',
  '3.11.7E',
  '3.11.8E',
  '3.11.9E',
  '3.11.10E',
  '3.11.11E',
  '3.11.12E',
  '3.16.8S',
  '3.16.9S',
  '3.16.10S',
  '3.16.10aS',
  '3.16.10bS',
  '3.18.5SP',
  '3.18.6SP',
  '3.18.7SP',
  '3.18.8aSP',
  '3.18.9SP',
  '16.6.5',
  '16.6.5a',
  '16.6.5b',
  '16.6.6',
  '16.6.7',
  '16.6.7a',
  '16.6.8',
  '16.6.9',
  '16.6.10',
  '16.8.1',
  '16.8.1a',
  '16.8.1b',
  '16.8.1c',
  '16.8.1d',
  '16.8.1e',
  '16.8.1s',
  '16.8.2',
  '16.8.3',
  '16.9.1',
  '16.9.1a',
  '16.9.1b',
  '16.9.1c',
  '16.9.1d',
  '16.9.1s',
  '16.9.2',
  '16.9.2a',
  '16.9.2s',
  '16.9.3',
  '16.9.3a',
  '16.9.3h',
  '16.9.3s',
  '16.9.4',
  '16.9.4c',
  '16.9.5',
  '16.9.5f',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.9.8b',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '16.12.13',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.9.6',
  '17.9.6a',
  '17.9.6b',
  '17.9.7',
  '17.9.7a',
  '17.9.7b',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.11.99SW',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.1z2',
  '17.12.1z3',
  '17.12.1z4',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.12.5',
  '17.12.5a',
  '17.12.5b',
  '17.12.5c',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w',
  '17.15.1x',
  '17.15.1y',
  '17.15.2',
  '17.15.2a',
  '17.15.2b',
  '17.15.2c',
  '17.15.3',
  '17.15.3a',
  '17.15.3b'
);

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwm99306'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);