CVE-2002-1092: Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, when configured to use internal authentication...

Security readout for executives and security teams

This flaw can let a remote VPN user authenticate to an affected Cisco VPN 3000 Concentrator under a specific internal-authentication setup. The business risk is unauthorized VPN access into protected networks if legacy appliances still exist with group accounts but no user accounts. Exposure is limited to legacy Cisco VPN 3000 deployments matching the exact authentication configuration. Internet-facing VPN concentrators would be the highest concern. The provided sources do not identify other products or modern Cisco VPN platforms as affected. Treat as urgent only if legacy Cisco VPN 3000 systems remain in service. The issue can undermine VPN access control, but most modern environments should be unaffected unless old appliances are still exposed. Mitigation focus: Identify any Cisco VPN 3000 Concentrators still deployed or reachable.; Check Cisco’s advisory for fixed software and vendor-approved remediation.; Avoid internal authentication using only group accounts without user accounts..

Prepared

Jun 30, 2026, 04:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.