Cisco yesterday patched a critical vulnerability in its Security Agent Management Center (CSAMC) software that could allow remote attackers to bypass authentication and gain unfettered access to the application.

CSAMC is used to configure security policies for networked servers and desktop PCs. The flaw affects CSAMC version 5.1 with hotfix prior to 5.1.0.79, which is the first version of the software that can authenticate users via the Lightweight Directory Access Protocol (LDAP).

If CSAMC has the LDAP option enabled, a remote attacker could gain access to the Web-based interface of the application by entering a valid administrative user name along with a blank password, according to a Cisco advisory.

CRN