Standard
TACACS+ is a protocol for centralized authentication, authorization, and accounting of network device logins; tac_plus is its common server daemon.
Elttam says two packets and an offline crack of weak encryption let attackers run code on TACACS+ servers before login. Only the Shrubbery Networks build has a patch, leaving sites on the archived Facebook fork to migrate or limit who can reach port 49.
Reality
Elttam says a TACACS+ server flaw lets attackers run code before login with two packets and an offline crack of the protocol's weak encryption. Of the two main server codebases, Shrubbery Networks' has a fix that still has no CVE and Facebook's archived fork will get none, so the first job is finding out which daemon answers on port 49.
Reality
Sygnia found the China-nexus group running packet captures, a tac_plus credential hook and two layers of log suppression on the gear that authenticates the rest of the estate, and it never established how the router was breached.
Perspective Coverage
6 publishersReality
Cisco's baseline reads plane by plane, but the load-bearing part is the password section, where Type 7 obfuscation is declared reversible with freely available online tools and older releases used it for BGP and TACACS+ keys alike.
Reality
Fire Ant treated routers, TACACS servers and Linux management hosts as the place to live rather than the place to pass through. The reported indicator list shows why that choice pays: the layer has almost no telemetry of its own.
Reality