CVE-2004-1775 in IOS
Summary
by MITRE
Cisco VACM (View-based Access Control MIB) for Catalyst Operating Software (CatOS) 5.5 and 6.1 and IOS 12.0 and 12.1 allows remote attackers to read and modify device configuration via the read-write community string.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/06/2025
The vulnerability described in CVE-2004-1775 represents a critical security flaw in Cisco's View-based Access Control MIB implementation within both CatOS and IOS operating systems. This issue affects versions 5.5 and 6.1 of CatOS as well as IOS versions 12.0 and 12.1, creating a significant risk for network administrators who rely on these platforms for their infrastructure security. The vulnerability stems from improper access control mechanisms that allow unauthorized remote attackers to gain elevated privileges through a simple community string attack vector.
The technical flaw resides in the implementation of the View-based Access Control Model (VACM) which is designed to provide fine-grained access control for SNMP operations within Cisco network devices. In affected versions, the system fails to properly validate access permissions when processing SNMP requests using read-write community strings. This weakness allows an attacker to bypass normal authentication mechanisms and directly manipulate device configurations without proper authorization. The vulnerability specifically affects the MIB (Management Information Base) operations that control access to sensitive network device parameters, making it particularly dangerous for network management and security functions.
From an operational perspective, this vulnerability creates a severe risk for network infrastructure security as it enables remote attackers to perform both read and write operations on critical device configurations. An attacker could potentially extract sensitive information such as user credentials, network topology details, and security policies from the device configuration files. Additionally, the ability to modify configurations allows for persistent attacks including disabling security features, creating backdoor accounts, or redirecting network traffic to malicious endpoints. This vulnerability essentially provides a complete compromise of the affected device's management interface, undermining the fundamental security model of the network infrastructure.
The impact of this vulnerability aligns with CWE-284 Access Control Issues, specifically addressing improper access control mechanisms that allow unauthorized access to system resources. From an ATT&CK framework perspective, this vulnerability maps to techniques such as T1078 Valid Accounts for initial access and T1566 Phishing for initial compromise, while also enabling T1059 Command and Scripting Interpreter for executing malicious commands. Organizations using affected Cisco devices face significant risk of unauthorized network access, configuration manipulation, and potential lateral movement within their network infrastructure. The vulnerability also creates opportunities for attackers to establish persistent access and conduct advanced persistent threat operations.
Mitigation strategies should focus on immediate patching of affected devices to the latest available software versions that contain fixes for the VACM implementation. Network administrators should also implement strict SNMP access controls by disabling unnecessary SNMP community strings and enforcing the use of more secure authentication mechanisms such as SNMPv3. Additional protective measures include implementing network segmentation to limit access to management interfaces, deploying intrusion detection systems to monitor for suspicious SNMP activity, and establishing robust network access control policies that restrict which systems can communicate with device management interfaces. Regular security audits and configuration reviews should be conducted to ensure that access controls remain properly enforced and that no unauthorized modifications have occurred.