Elttam's two-packet exploit runs code on TACACS+ servers before anyone logs in

The code Elttam broke runs on the central server. When someone logs into a switch or router, the device asks the network's TACACS+ server whether that user exists and what they may do ^[4]. The server checks the password, authorises operations and logs the session. All of it happens on port 49 ^[3]. Elttam says it can run its own code on that server before any authentication takes place ^[6]. The routers are clients here. The thing to find and patch is the daemon they all consult.

The attacker's live traffic is small. Elttam's main route needs two packets and an offline crack of the protocol's weak encryption ^[7]. Offline means the cracking runs on the attacker's own hardware. A lockout counter or failed-login alert on the server never sees those attempts.

Reachability decides which route an attacker gets. The two-packet version works over the internet or a local network, but only with a direct line to the central server ^[7]. The alternative goes through intermediary devices at the network edge. Researchers say it is less reliable because device makers and models support the protocol in different ways ^[8]. Filtering which hosts can reach port 49 on the server pushes an attacker onto that error-prone path and buys time until the patch is installed.

Getting that patch took longer than finding the bug, according to Elttam ^[9]. Cisco walked away from the protocol in the late 1990s ^[10]. Two main server codebases remain: one maintained by Shrubbery Networks and a fork maintained by Facebook ^[10]. Neither had shipped an update in more than half a decade ^[11]. It is a slow inbox for software that decides who may log into a network's routers: Elttam waited almost nine months for replies to its emails ^[11].

Shrubbery Networks has now released patches for its version, but no CVE has been assigned ^[12]. A patch program that tracks work by CVE ID has nothing to match against yet. For now, checking versions is a manual job. The Facebook fork has long been archived and is no longer maintained ^[13]. I think anyone still running it has a migration project, because no fix is coming for that code. The report does not say whether commercial TACACS+ servers share the affected code.

Elttam's warning about who wants these servers is specific. The firm says at least two Chinese cyber-espionage groups, Salt Typhoon and Fire Ant, have exploited TACACS+ over the past two years in operations against telecommunications companies worldwide ^[14]. Both went after TACACS servers for persistence and lateral movement, mainly because of the protocol's central role in modern networks ^[15]. That role covers a lot of networks. The protocol is built into almost all modern networking equipment and is used at almost all large enterprises, ISPs, data centers and cloud providers ^[5].