Is CVE-2013-3466 being actively exploited?

CVE-2013-3466 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-3466?

CVE-2013-3466 has a CVSS 2.0 base score of 9.3 (HIGH).

CVE-2013-3466

HIGH · CVSS 9.3EPSS 5.1%EU EUVD

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.

Key facts

CVSS score: 9.3 (v2.0)
Severity: HIGH
CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness (CWE): CWE-287
EPSS score: 5.1% (92th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2013-3401)
Published: August 29, 2013
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-3401 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server
cisco / secure access control server

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Cisco Systems (1100, 1200, 1300, 1400 series Wireless Devices running IOS 12.3 (8JA2; 3200 series Wireless Router running IOS 12..4(6)XE3; AS5350, 5400, 5850 Universal Gateway running IOS 12.4(17); IAD2430 Integrated Access Device running IOS 12.4(17) with Cisco Secure Access Control Server (ACS) version 4.1.4.13 for Microsoft Windows Server - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-6013-2008 - archived

References

http://osvdb.org/96668
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130828-acs(Vendor Advisory)
http://www.securitytracker.com/id/1028958(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain