CVE-2023-48643

Deeper analysis

Shrubbery tac_plus versions 2.x, 3.x, and 4.x through F4.0.4.28 contain a command injection vulnerability that permits unauthenticated remote code execution. The software supports configuring authorization checks as shell commands in tac_plus.cfg, which are invoked on authorization requests for specific usernames. Because TACACS+ packet fields are passed directly as command-line arguments without sanitization, an attacker can supply additional shell commands. The issue is exacerbated when no pre-shared secret is configured, the default state, and is distinct from the related flaw in Meta's tac_plus fork tracked as CVE-2023-45239.

An unauthenticated remote attacker who knows a username with pre-authorization directives can send a crafted TACACS+ authorization packet to execute arbitrary commands on the server. Successful exploitation grants full control over the affected host, including the ability to read, modify, or delete data and to pivot further into the network, consistent with the CVSS 9.8 rating reflecting network-accessible attack with no required credentials or user interaction.

Public references point to proof-of-concept material hosted at https://github.com/takeshixx/tac_plus-pre-auth-rce, but no vendor advisory or official patch information is included in the supplied references. The EPSS score rose from a low baseline to a recorded peak of 0.0911, indicating emerging exploitation interest after disclosure.