Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.

elttam is a globally recognised, independent information security company, renowned for our advanced technical security assessments.

elttam is a globally recognised, independent information security company, renowned for our advanced technical security assessments.

Talkback is an AI-powered infosec resource aggregator to be more productive with cyber security content.

YouTube video by BSides Canberra