QID 317009

The Cisco ASA or Cisco PIX security appliance can be configured to override an account-disabled indication from a AAA server and
allow the user to log on anyway.
However, the user must provide the correct credentials in order to login to the VPN.
A vulnerability exists in the Cisco ASA and Cisco PIX security appliances where VPN users can bypass authentication when the override account feature is enabled. Note: The override account feature was introduced in Cisco ASA software version 7.1(1) Potential detection as cannot confirm if override account feature is enabled. No support for Cisco PIX security appliance.

Affected Products
Cisco ASA or Cisco PIX security appliances that are configured for IPsec or SSL-based remote access VPN and have the Override Account Disabled feature enabled running vulnerable versions : From 7.1(1) Prior to 7.1(2)82
From 7.2 Prior to 7.2(4)27
From 8.0 Prior to 8.0(4)25
From 8.1 Prior to 8.1(2)15

QID Detection Logic (Authenticated):
The check matches Cisco ASA OS version retrieved via Unix Auth using "version" command.

Successful exploitation may lead to unauthorized access.