ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam
www.elttam.com
Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.