CVE-2004-1099

no score yetEPSS 10%

cisco: no CVSS score yet. EPSS 10% chance of exploitation in the next 30 days.

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and gain unauthorized access via a "cryptographically correct" certificate with valid fields such as the username.

EPSS: 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
Published: 2005-01-10
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

cisco:secure_access_control_server
cisco:secure_acs_solution_engine

References

http://www.ciac.org/ciac/bulletins/p-028.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20041102-acs-eap-tls.shtml
http://www.securityfocus.com/bid/11577
https://exchange.xforce.ibmcloud.com/vulnerabilities/17936
http://www.ciac.org/ciac/bulletins/p-028.shtml

Check your stack JSON