Elttam's two-packet TACACS+ exploit runs code on the servers that approve router logins

Port 49 carries the login decision for network gear ^[3]. When a user logs into a switch or router, the device asks the TACACS+ server whether that user exists and what access they have ^[4]. The server checks the password, allows specific operations and logs what the user does ^[3]. The protocol is built into almost all modern networking equipment and used at almost all large enterprises, ISPs, data centers and cloud providers ^[5].

How exploitable the flaw is depends on network reach. Elttam's reliable path needs packets to arrive at the central server itself ^[7]. The researchers say they can also reach the server through intermediary devices at the network edge. That variant is error-prone, because vendors and models support the protocol differently ^[8]. In my view, the first control is a server that accepts port 49 traffic only from the devices it authenticates. That removes the dependable route and leaves an attacker only the error-prone one, through a device the server already trusts ^[7][8]. For sites on the archived fork, it is the one control that does not depend on a maintainer ^[13].

Cisco released TACACS+ in 1993 as an upgrade to the 1984 TACACS protocol, then abandoned it in the late 1990s ^[2][10]. Two major versions were left: one from Shrubbery Networks and a fork from Facebook ^[10]. Neither project had released an update in more than half a decade. Elttam says it took almost nine months to get replies to its emails ^[11]. The firm says finding the bug was hard and getting it patched was far more difficult ^[9].

Elttam's warning about Salt Typhoon and Fire Ant is about which hosts those groups go after. Both targeted TACACS servers for persistence and lateral movement, primarily because of the protocol's central role in modern networks ^[15]. As Risky Bulletin reports it, the warning does not tie either group to this specific flaw ^[14][15].