Cisco referred in an error report to a weak point in Cisco the Security agent management center (CSAMC), with which an unauthorized user can cheat and as administrator announce himself. Over the Security agent management center the Security Agents (CSA) for Clients and servers over the net are configured. An aggressor could deactivate the protection with privileged rights by CSAs on all devices.

However the attack functions only, if CSMAC uses a LDAP server to the something strange, which in the standard configuration the case is not. Otherwise it hands to indicate the names of a valid administrator account and to leave the password empty during the registration as well as a certain error message of the LDAP server to the CSMAC. In the consequence measure-interpret the CSMAC the log in procedure as valid. Only version 5.1 CSMAC, an update is concerned repairs the problem.

See in addition also:
= Cisco Security agent management center LDAP administrator Authentication bypass, error report by Cisco