{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:13:04Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20070105-CVE-2006-4097","slug":"cisco-sa-20070105-cve-2006-4097","vendor":"Cisco","title":"Cisco Secure Access Control Server Access-Request Handling Denial of Service Vulnerability","summary":"Cisco Secure Access Control Server for Windows and Cisco Secure Access Control Server Solution Engine contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability exists due to insufficient handling of malformed RADIUS Access-Request messages.  An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted RADIUS Access-Request network packet to an affected system, crashing the CSRadius process.  This renders the system unresponsive to further RADIUS Authentication, Authorization, and Accounting requests. Cisco has confirmed this vulnerability in a security advisory and released updated software to correct it. To exploit this vulnerability, an attacker requires no special authentication credentials and requires no access to shared RADIUS keys.  To accomplish an exploit, an attacker needs to send a crafted network request to an affected system.  This likely requires the attacker to have access to trusted, internal networks or to be within range of wireless access.  In the event of an exploit, attackers can render RADIUS systems unresponsive, denying authentication services to authorized users.  TACACS+ functionality will still be operational, however. Functional exploit code that proves the exploitability of this vulnerability is reported by the vendor but is not available publicly.  However, because the viability of exploitation has been proven, attackers may be more likely to develop exploit code.","severity":"Medium","published_at":"2007-01-05T23:22:58Z","updated_at":"2007-01-05T23:22:58Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20070105-CVE-2006-4097","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20070105-CVE-2006-4097/csaf/Cisco-SA-20070105-CVE-2006-4097.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":2,"public_evidence_count":2,"kev_count":0},"cves":[{"id":"CVE-2006-4097","kev":false}],"public_evidence":[{"product":{"name":"Cisco Secure Access Control Server (ACS) for Windows","slug":"cisco-secure-access-control-server-acs-for-windows","vendor":"Cisco"},"cve":{"id":"CVE-2006-4097"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:34:53Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Secure Access Control Server (ACS) for Windows","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-01-05T23:22:58Z","updated_at":"2007-01-05T23:22:58Z","advisory_updated_at":"2007-01-05T23:22:58Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20070105-CVE-2006-4097","row_display_order":1},{"product":{"name":"Cisco Secure Access Control Server Solution Engine (ACSE)","slug":"cisco-secure-access-control-server-solution-engine-acse","vendor":"Cisco"},"cve":{"id":"CVE-2006-4097"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:34:53Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Secure Access Control Server Solution Engine (ACSE)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-01-05T23:22:58Z","updated_at":"2007-01-05T23:22:58Z","advisory_updated_at":"2007-01-05T23:22:58Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20070105-CVE-2006-4097","row_display_order":2}]}