Re: Shrubbery's tac_plus - inclusion in other products?

[Christopher Morrow via NANOG <nanog () lists nanog org>]

Did you send a note to the author about this? (heas () shrubbery net, probably)

On Wed, Sep 23, 2026 at 6:01 PM Royce Williams via NANOG
<nanog () lists nanog org> wrote:
> Do any TACACS+-speaking solutions (current or legacy) have a basis on
> the Shrubbery fork of tac_plus?
>
> There's an unauth'd RCE in just about all versions (no CVE yet):
>
> https://github.com/elttam/publications/blob/master/writeups/elttam-tac_plus_rce_fmtstring_advisory.txt
>
> Some threat-intel folks are collecting what we know here (disclosure:
> my post, but it's volunteer), so if anyone replies (here or on the
> side), I'll update here:
>
> https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859/1
>
> I'm interested in legacy / EOL platform info as well -- like some are
> still in the field. And upstream updates are sporadic (until this year
> when .31 was released, there hadn't been a release since .28 in 2015),
> so embedding could go way back.
>
> I don't have vendor access anymore, so any feedback / corrections appreciated.
>
> --
> Royce Williams
> Tech Solvency
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/AY32ZYSY7ZRWSHNWZF74TNNHVZNYOY5I/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/UE3QHQRMX33P3YQYFXY2QGJKWAHQU4AA/