{"api_version":"1","generated_at":"2026-07-23T06:58:01+00:00","cve":"CVE-2014-8027","urls":{"html":"https://cve.report/CVE-2014-8027","api":"https://cve.report/api/cve/CVE-2014-8027.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8027","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8027"},"summary":{"title":"CVE-2014-8027","description":"The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034.","state":"PUBLISHED","assigner":"cisco","published_at":"2015-01-09 02:59:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/71944","name":"http://www.securityfocus.com/bid/71944","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Secure Access Control Server CVE-2014-8027 Privilege Escalation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100558","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100558","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1031516","name":"http://www.securitytracker.com/id/1031516","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Secure Access Control Server Lets Remote Authenticated Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/62159","name":"http://secunia.com/advisories/62159","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8027","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8027","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8027","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"secure_access_control_system","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:10:50.014Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"71944","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/71944"},{"name":"20150108 Cisco Secure Access Control Server Privilege Escalation Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027"},{"name":"cisco-secureacs-cve20148027-priv-esc(100558)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100558"},{"name":"1031516","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031516"},{"name":"62159","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/62159"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-01-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-07T15:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"71944","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/71944"},{"name":"20150108 Cisco Secure Access Control Server Privilege Escalation Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027"},{"name":"cisco-secureacs-cve20148027-priv-esc(100558)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100558"},{"name":"1031516","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031516"},{"name":"62159","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/62159"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-8027","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"71944","refsource":"BID","url":"http://www.securityfocus.com/bid/71944"},{"name":"20150108 Cisco Secure Access Control Server Privilege Escalation Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027"},{"name":"cisco-secureacs-cve20148027-priv-esc(100558)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100558"},{"name":"1031516","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031516"},{"name":"62159","refsource":"SECUNIA","url":"http://secunia.com/advisories/62159"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-8027","datePublished":"2015-01-09T02:00:00.000Z","dateReserved":"2014-10-08T00:00:00.000Z","dateUpdated":"2024-08-06T13:10:50.014Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-09 02:59:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*","matchCriteriaId":"716A2EC7-4A03-4BB9-B787-6DD285E25056"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8027","Ordinal":"1","Title":"CVE-2014-8027","CVE":"CVE-2014-8027","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8027","Ordinal":"1","NoteData":"The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034.","Type":"Description","Title":"CVE-2014-8027"},{"CveYear":"2014","CveId":"8027","Ordinal":"2","NoteData":"2015-01-08","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8027","Ordinal":"3","NoteData":"2017-09-07","Type":"Other","Title":"Modified"}]}}}