CVE-2005-4332

CVE-2005-4332 is a critical-severity vulnerability in Cisco Network Admission Control Manager And Server System Software with a CVSS 2.0 base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: Critical (CVSS 2.0 base score 9.4)
• EPSS exploit prediction: 4% (89th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Cisco Network Admission Control Manager And Server System Software
• Published: 2005-12-17
• Last modified: 2026-06-16

Description

Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_action.jsp, and (3) file.jsp.

Frequently asked questions

What is CVE-2005-4332?

Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_action.jsp, and (3) file.jsp.

How severe is CVE-2005-4332?

CVE-2005-4332 has a CVSS 2.0 base score of 9.4, rated critical severity.

Is CVE-2005-4332 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (89th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2005-4332?

CVE-2005-4332 primarily affects Cisco Network Admission Control Manager And Server System Software. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2005-4332?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2005-4332 published?

CVE-2005-4332 was published on 2005-12-17 and last updated on 2026-06-16.

References

• http://secunia.com/advisories/18103
• http://securityreason.com/securityalert/265
• http://securitytracker.com/id?1015375
• http://www.awarenetwork.org/forum/viewtopic.php?p=2236
• http://www.cisco.com/warp/public/707/cisco-response-20051221-CCA.shtml
• http://www.osvdb.org/21956
• http://www.osvdb.org/21957
• http://www.osvdb.org/21958
• http://www.securityfocus.com/archive/1/419645/100/0/threaded
• http://www.securityfocus.com/archive/1/420008/100/0/threaded
• http://www.securityfocus.com/bid/15909
• http://www.vupen.com/english/advisories/2005/3007

Affected products (22)

• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.5:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.6:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.7:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.8:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.3.9:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4.2:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4.3:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4.4:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.4.5:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5.1:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5.2:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5.3:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5.4:*:*:*:*:*:*:*
• cpe:2.3:a:cisco:network_admission_control_manager_and_server_system_software:3.5.5:*:*:*:*:*:*:*

More vulnerabilities in Cisco Network Admission Control Manager And Server System Software

• CVE-2007-0057 — Critical (CVSS 10.0): Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow…
• CVE-2007-0058 — High (CVSS 7.8): Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote…
• CVE-2013-1177 — High (CVSS 7.5): SQL injection vulnerability in Cisco Network Admission Control (NAC) Manager before 4.8.3.1 and 4.9.x before 4.9.2…
• CVE-2005-2631 — High (CVSS 7.5): Cisco Clean Access (CCA) 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 does not properly authenticate users when…
• CVE-2005-4825 — Medium (CVSS 5.7): Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and…
• CVE-2006-4430 — Medium (CVSS 5.0): The Cisco Network Admission Control (NAC) 3.6.4.1 and earlier allows remote attackers to prevent installation of the…

All CVEs affecting Cisco Network Admission Control Manager And Server System Software →