CVE-2017-3840: A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthe...

Security readout for executives and security teams

Cisco Secure ACS had an open redirect flaw in its web interface. An attacker could abuse a trusted ACS URL to send a user to a malicious page. This is mainly a phishing and trust-abuse risk, not evidence of direct ACS takeover from the supplied sources. Exposure is most likely where Cisco Secure ACS 5.8(2.5) web interfaces remain deployed and reachable by administrators or users. Internet exposure would increase phishing utility, but the source bundle does not prove broad exposure. Treat this as a cleanup and phishing-risk reduction item, especially for legacy identity infrastructure. It is not supported as actively exploited in the supplied sources, but ACS is security-sensitive and should not remain exposed or outdated. Mitigation focus: Check Cisco advisory CSCvc04849 for fixed releases or vendor workarounds.; Restrict ACS web interface access to trusted administrative networks.; Retire or upgrade legacy Cisco Secure ACS deployments where feasible..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.