CVE-2004-1112: The buffer overflow trigger in Cisco Security Agent (CSA) before 4.0.3 build 728 waits five minutes for a u...

Security readout for executives and security teams

This CVE affects Cisco Security Agent’s buffer-overflow protection. Instead of immediately stopping a suspicious process, affected versions wait up to five minutes for user input. During that window, an attacker may keep attacking and bypass the protection the agent was meant to provide. Exposure is likely limited to environments still running Cisco Security Agent versions before 4.0.3 build 728. This is a legacy product scenario, so confirm through endpoint and server inventories rather than assuming current exposure. Treat this as a targeted legacy exposure check, not a broad emergency. Priority rises if CSA still protects critical legacy servers because the flaw weakens a core exploit-prevention control. Mitigation focus: Inventory Cisco Security Agent installations and build numbers.; Upgrade affected CSA deployments to 4.0.3 build 728 or later where applicable.; Review Cisco’s advisory for supported remediation guidance..

Prepared

Jun 30, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.