{"api_version":"1","generated_at":"2026-07-24T17:16:59+00:00","cve":"CVE-2009-2862","urls":{"html":"https://cve.report/CVE-2009-2862","api":"https://cve.report/api/cve/CVE-2009-2862.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-2862","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-2862"},"summary":{"title":"CVE-2009-2862","description":"The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252.","state":"PUBLISHED","assigner":"cisco","published_at":"2009-09-28 19:30:01","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-noinfo","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml","name":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability  [Products & Services] - Cisco Systems","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2009/2759","name":"http://www.vupen.com/english/advisories/2009/2759","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1022933","name":"http://www.securitytracker.com/id?1022933","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"Cisco IOS Object Groups for ACLs Lets Remote Users Bypass Access Controls - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/36495","name":"http://www.securityfocus.com/bid/36495","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco IOS Object Group Access Control List Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://osvdb.org/58338","name":"http://osvdb.org/58338","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2862","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2862","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.2xnb","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.2xnc","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.2xnd","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.4md","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.4t","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.4xz","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2862","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios","cpe6":"12.4ya","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:07:37.190Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"58338","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/58338"},{"name":"ADV-2009-2759","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/2759"},{"name":"1022933","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1022933"},{"name":"36495","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/36495"},{"name":"20090923 Cisco IOS Software Object-group Access Control List Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-09-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2009-10-01T09:00:00.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"58338","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/58338"},{"name":"ADV-2009-2759","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/2759"},{"name":"1022933","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1022933"},{"name":"36495","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/36495"},{"name":"20090923 Cisco IOS Software Object-group Access Control List Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2009-2862","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"58338","refsource":"OSVDB","url":"http://osvdb.org/58338"},{"name":"ADV-2009-2759","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/2759"},{"name":"1022933","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1022933"},{"name":"36495","refsource":"BID","url":"http://www.securityfocus.com/bid/36495"},{"name":"20090923 Cisco IOS Software Object-group Access Control List Bypass Vulnerability","refsource":"CISCO","url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=18876"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2009-2862","datePublished":"2009-09-28T18:20:00.000Z","dateReserved":"2009-08-19T00:00:00.000Z","dateUpdated":"2024-08-07T06:07:37.190Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-09-28 19:30:01","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-noinfo","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.2xnb:*:*:*:*:*:*:*","matchCriteriaId":"17AA0C3D-7C96-4D2E-91E5-232536245ABF"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.2xnc:*:*:*:*:*:*:*","matchCriteriaId":"5D57ACB3-4ADC-4FBE-BA46-395F277B9997"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.2xnd:*:*:*:*:*:*:*","matchCriteriaId":"E2916FA5-1FFF-48FB-A079-693AD3444CC1"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.4md:*:*:*:*:*:*:*","matchCriteriaId":"A2222EED-6CB2-4D18-8AF5-FAE55BC6213F"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.4t:*:*:*:*:*:*:*","matchCriteriaId":"BEAD7398-D1B2-47FB-952D-8C3162D5A363"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.4xz:*:*:*:*:*:*:*","matchCriteriaId":"4963A243-74FA-43AD-9645-C9FAD527A6E1"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios:12.4ya:*:*:*:*:*:*:*","matchCriteriaId":"31C6EACA-35BE-4032-93DA-5F738AEE0F4A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"2862","Ordinal":"1","Title":"CVE-2009-2862","CVE":"CVE-2009-2862","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"2862","Ordinal":"1","NoteData":"The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252.","Type":"Description","Title":"CVE-2009-2862"},{"CveYear":"2009","CveId":"2862","Ordinal":"2","NoteData":"2009-09-28","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"2862","Ordinal":"3","NoteData":"2009-10-01","Type":"Other","Title":"Modified"}]}}}