CVE-2010-4685: Cisco IOS before 15.0(1)XA1 does not clear the public key cache upon a change to a certificate map, which a...

Security readout for executives and security teams

A flaw in older Cisco IOS could let a previously trusted certificate continue working after administrators tried to ban it. The issue matters where certificate-based access decisions protect network services. The attacker must already be authenticated and have a certificate that was valid before being banned. Exposure is likely limited to Cisco IOS deployments before 15.0(1)XA1 using certificate maps to deny or ban certificates. Systems not using certificate-based controls or certificate maps are less likely to be affected based on the provided sources. Prioritize review for network devices that rely on certificate bans for access control. This is not shown as actively exploited, but it can undermine trust decisions on infrastructure where former users, devices, or certificates must be blocked reliably. Mitigation focus: Identify Cisco IOS systems older than 15.0(1)XA1.; Review Cisco release notes and vendor guidance for CSCta79031.; Upgrade affected Cisco IOS deployments where the vendor-supported fix applies..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.