Cisco Security Advisory – A Cisco Secure Access Control Server (ACS) that is configured to use Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) to authenticate users to the network will allow access to any user that uses a cryptographically correct certificate as long as the user name is valid. Cryptographically correct means that the certificate is in the appropriate format and contains valid fields. The certificate can be expired, or come from an untrusted Certificate Authority (CA) and still be cryptographically correct. Only version 3.3.1 of the Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine is affected by this vulnerability.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34933/cisco-sa-20041102-acs-eap-tls.txt
Source: https://packetstormsecurity.com/files/34933/Cisco-Security-Advisory-20041102-acs-eap-tls.html