{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:31:52Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-20080312-ucp","slug":"cisco-sa-20080312-ucp","vendor":"Cisco","title":"Cisco Secure Access Control Server for Windows User-Changeable Password Vulnerabilities","summary":"Two sets of vulnerabilities were discovered in the Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application and reported to Cisco by Felix 'FX' Lindner, Recurity Labs GmbH. The first set of vulnerabilities address several buffer overflow conditions in the UCP application that could result in remote execution of arbitrary code on the host system where UCP is installed. The second set of vulnerabilities address cross-site scripting in the UCP application pages. Both sets of vulnerabilities could be remotely exploited, and do not require valid user credentials. Cisco has released a free software update for UCP that addresses these vulnerabilities. There are no workarounds that mitigate these vulnerabilities. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp.","severity":"Medium","published_at":"2008-03-12T16:00:00Z","updated_at":"2008-03-12T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-20080312-ucp/csaf/cisco-sa-20080312-ucp.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":2,"visible_product_count":2,"public_evidence_count":2,"kev_count":0,"highest_epss":0.28789},"cves":[{"id":"CVE-2008-0533","kev":false,"epss":{"score":0.28789,"percentile":0.97938,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}},{"id":"CVE-2008-0532","kev":false}],"public_evidence":[{"product":{"name":"Cisco Secure Access Control Server (ACS) for Windows","slug":"cisco-secure-access-control-server-acs-for-windows","vendor":"Cisco"},"cve":{"id":"CVE-2008-0533"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:34:51Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Secure Access Control Server (ACS) for Windows","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.28789,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2008-03-12T16:00:00Z","updated_at":"2008-03-12T16:00:00Z","advisory_updated_at":"2008-03-12T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp","row_display_order":1},{"product":{"name":"Cisco User-Changeable Password Utility (UCP)","slug":"cisco-user-changeable-password-utility-ucp","vendor":"Cisco"},"cve":{"id":"CVE-2008-0533"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:34:51Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco User-Changeable Password Utility (UCP)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.28789,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2008-03-12T16:00:00Z","updated_at":"2008-03-12T16:00:00Z","advisory_updated_at":"2008-03-12T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp","row_display_order":2}]}