#TACACS
LightNews LightNews
euvd-bot.bsky.social
🚨 EUVD-2026-118431
📊 5.9/10
🏢 SonicWall

📝 A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific cond...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118431

#cybersecurity #infosec #cve #euvd
November 6, 2026 at 8:03 PM
euvd-bot.bsky.social
🚨 EUVD-2026-118430
📊 5.9/10
🏢 SonicWall

📝 A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific con...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118430

#cybersecurity #infosec #cve #euvd
November 6, 2026 at 8:03 PM
hugovalters.bsky.social
Netmiko + ED25519 keys via use_keys/key_file, plus a TACACS enable secret for privilege escalation. https://www.valtersit.com/vault/netmiko-sessions-with-tacacsbacked-credentials-and-ssh-keys-4b89cf/
Netmiko Sessions with TACACS-Backed Credentials and SSH Keys
www.valtersit.com
November 4, 2026 at 8:10 AM
db-user.bsky.social
AI QUIZLET PLZ
A little quiz over TACACS+ and RADIUS, question snippet showing correct answers, but they're all marked as incorrect. Detailed text below: Match each AAA protocol characteristic to the correct protocol. Uses TCP port 49 - Answer: TACACS+; Result: Incorrect, correct answer TACACS+ Stateless protocol - Answer: RADIUS; Result: Incorrect, correct answer RADIUS Encrypts entire body - Answer: TACACS+; Result: Incorrect, correct answer TACACS+ Uses UDP ports 1812 and 1813 - Answer: RADIUS; Result: Incorrect, correct answer RADIUS
October 21, 2026 at 7:03 PM
threadlinqs.bsky.social
Fire Ant hides a GRE tunnel in Cisco IOS XR and steals TACACS+ creds from live tac_plus memory. https://intel.threadlinqs.com/threat/TL-2026-4123 #ThreatIntel #BridgeAgent #TacTap #Nexus
October 22, 2026 at 8:18 AM
euvd-bot.bsky.social
🚨 EUVD-2026-101356
📊 9.3/10
🏢 Juniper Networks

📝 An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to exec...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101356

#cybersecurity #infosec #cve #euvd
October 16, 2026 at 5:02 AM
stemshop.bsky.social
🚨 CVE-2026-102031 — CVSS 9.3 CRITICAL

An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privilege...

🔎 https://stemshop.top/cve/CVE-2026-102031

#CVE #CyberSecurity #InfoSec
October 14, 2026 at 6:10 PM
stackflag.bsky.social
CVE-2026-102031 - junos os evolved
Junos OS Evolved can be tricked by a user with only basic TACACS+ rights to run commands as the system administrator when the periodic authorization‑refresh feature is…

Too many irrelevant or confusing CVEs? Use stackflag.com

#junipernetworks #CVE #infosec
CVE-2026-102031: Junos OS Evolved lets low-level user run admin commands
Junos OS Evolved can be tricked by a user with only basic TACACS+ rights to run commands as the system administrator when the periodic.
stackflag.com
October 14, 2026 at 6:30 PM
redhotcyber.bsky.social
Un bug degli anni 90 porta all’accesso robot suo server TACACS+

📌 Link all'articolo : www.redhotcyber.com/post/un-bug-...

Carolina Vivianti

#redhotcyber #cybersecurity #cybercrime #hacking #cti #ai #privacy #news #technology
October 4, 2026 at 7:33 AM
elttam.bsky.social
New blog post: ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE

A format string vulnerability that's been lurking 25+ years, and the PSK oracle chain that unlocks it

www.elttam.com/blog/att-cki...
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.
www.elttam.com
September 27, 2026 at 11:32 PM
cyberhub.blog
📌 ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE https://www.cyberhub.blog/article/32528-attcking-tacacs-to-pwn-your-network-via-a-pre-auth-rce
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE
The Reddit post shares a link to an elttam blog article about TACACS+. The post title indicates the content relates to a pre-authentication remote code execution vulnerability affecting TACACS+. The linked article URL is from elttam's blog at www.elttam.com/blog/att-cking-tacacs-to-pwn-your-network-via-a-pre-auth-rce.
www.cyberhub.blog
September 27, 2026 at 5:07 AM
spuluka.bsky.social
Interesting deep dive from @elttam.bsky.social on an RCE exploit to TACACS+ protocol servers commonly used in networking authentication. They believe it is already in use against telecomm companies for Chinese espionage.

www.elttam.com/blog/att-cki...
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.
www.elttam.com
September 27, 2026 at 9:18 AM
r-blueteamsec.bsky.social
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE
www.elttam.com
September 25, 2026 at 5:09 PM
getpokemon7.bsky.social
Fire Ant攻撃者がCiscoルーターとTACACSサーバーを侵害し、重要インフラを標的に

中国と関係のある脅威アクターであるFire Antは、スパイ活動の対象をVMwareハイパーバイザーから信頼できるインフラストラクチャ層へと拡大し、Cisco IOS XRルーター、TACACS認証サーバー、Linux管理ホストを侵害した。

この活動を調査したセキュリティ企業Sygniaによると、Fire Antは2025年に初めて報告されて以来、活動を続けているという。

この俳優の最新の作戦は、従来のエンドポイントではなく、インフラストラクチャ制御プレーン資産への意図的なシフトを示している。
Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure
China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco IOS XR routers.
gbhackers.com
September 26, 2026 at 3:34 AM
Not only an unauth RCE on tac_plus, but a way to try to crack the TACACS secret remotely
www.elttam.com/blog/att-cki...
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.
www.elttam.com
September 25, 2026 at 11:44 AM
campuscodi.risky.biz
-Major vulnerability found in ancient TACACS+ networking protocol
-OpenAI agent hacked Australian Medicare website
-Three other OpenAI incidents
-OpenAI gives Ukraine access to Daybreak
-UK to establish anti-disinformation center

P: risky.biz/RBNEWS615/
N: news.risky.biz/risky-bullet...
September 25, 2026 at 7:57 AM
getpokemon7.bsky.social
中国関連の「ファイアアント」がシスコ製ルーターを乗っ取り、認証情報を盗み、セキュリティログを無効化

Fire Antという名称で追跡されている中国関連のサイバースパイ集団は、VMwareハイパーバイザーにとどまらず、Cisco IOS XRルーター、ターミナルアクセスコントローラーアクセス制御システム（TACACS）サーバー、および高価値ネットワークのルーティング、認証、管理に使用されるLinux管理ホストへの侵害など、長期にわたる活動を拡大している。

侵入事件を調査したインシデント対応企業Sygniaによると、攻撃者は侵害したルーターを収集プラットフォームに変え、ネットワークトラフ...
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
Fire Ant compromises Cisco IOS XR routers and TACACS servers to capture traffic, harvest credentials, and suppress defensive telemetry.
thehackernews.com
September 26, 2026 at 3:16 AM
alienrick.xyz
Listen. Your routers still speak TACACS+, a 1993 Cisco leftover on port 49. Elttam just got pre-auth RCE in two packets. Nine months to get a patch email because the maintainers ghosted the repo. Salt Typhoon already had a key. Morty, you locked the kingdom behind a museum exhibit. day269.001
September 25, 2026 at 4:27 PM
getpokemon7.bsky.social
中国のFire AntハッカーがCiscoルーターをスパイプラットフォームに改造

研究者たちは、Cisco IOS XRルーター上で、実行中の設定やコミット履歴では説明できないアクティブなGRE（汎用ルーティングカプセル化）トンネルインターフェースを発見したことから、Fire Antの新たな戦術を発見した。

インシデント対応企業Sygniaによると、攻撃者はVMwareハイパーバイザーを標的にしていたのに対し、Ciscoルーター、TACACS認証サーバー、Linux管理ホストへの攻撃に切り替えたという。

研究者たちは、Cisco IOS XRルーター上で、実行中の設定やコミット履歴...
Chinese Fire Ant hackers turn Cisco routers into spying platforms
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configur...
www.bleepingcomputer.com
September 26, 2026 at 3:24 AM
risky.biz.web.brid.gy
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol
A major vulnerability has been found in the ancient TACACS+ networking protocol, Australia’s Prime Minister claims an OpenAI agent hacked the country’s Medicare website, OpenAI gives Ukraine access to its Daybreak cyber-defense program and the UK will establish an anti-disinformation center.
risky.biz
September 25, 2026 at 6:40 AM
cyberveille-ch.bsky.social
📢 RCE pré-authentification dans tac_plus via format string 25 ans après sa création

Cet article de recherche détaille la découverte et l'exploitation d'une vulnérabilité de type format string (CWE-134) dans…

🟡 vérification factuelle moyenne
#RCEPréAuthentification #FormatString #Cyberveille
RCE pré-authentification dans tac_plus via format string 25 ans après sa création
Cet article de recherche détaille la découverte et l'exploitation d'une vulnérabilité de type format string (CWE-134) dans tacplus, le daemon TACACS+ issu du code de référence Cisco des années 1990. La vulnérabilité est qualifiée de CVE-pending au moment de la publication. La faille réside dans la fonction sendauthenerror() du fichier packet.c.
cyberveille.ch
September 25, 2026 at 1:30 PM
tychotithonus.infosec.exchange.ap.brid.gy
Who out there knows if/what commercial products use Shrubbery's `tac_plus` as a base for their TACACS+ services, and would be vulnerable to the RCE?

Need help checking products and adding missing ones. See tables at […]
Original post on infosec.exchange
infosec.exchange
September 23, 2026 at 5:53 PM
ifin-intel.org
A format string vulnerability in Shrubbery's TACACS+ library (and Facebook's archived fork of it) can lead to secret disclosure, DoS, and potentially remote code execution. No, Cisco gear isn't affected, but many other devices will be.

As of now, no CVE has been assigned.
CVE pending: pre-auth format-string bug in tac_plus (Shrubbery Networks)
Last Updated: 2026-09-23T15:47:14Z (UTC) CVE: TBA CVSSv3: tentative 9.8 (per vuln publisher, not ratified) What’s Happening Research firm elttam has disclosed a vulnerability in the Shrubbery fork of the tac_plus TACACS+ authentication library used in multiple networking devices. The vulnerability, if fully exploited, can lead to remote code execution on target devices. Crashing systems is also a possibility. Secret disclosure is a natural result of this vulnerability. The post is long,...
ifin.network
September 23, 2026 at 4:03 PM
tychotithonus.infosec.exchange.ap.brid.gy
RCE in tac_plus, common TACACS+
implementation. And perhaps underneath a number of commercial solutions that provide network authentication. Pre-auth vuln. No CVE yet. Goes back 25 years. "Shrubbery fixed it in F4.0.4.32, published on 21 September, and the Facebook fork is archived, so it will […]
Original post on infosec.exchange
infosec.exchange
September 23, 2026 at 1:12 PM
r-netsec.bsky.social
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
www.elttam.com
September 23, 2026 at 5:39 AM