Authenticated privilege escalation via SSH key misbinding

Authentication bypass in Cisco StarOS Software allows remote authenticated users to obtain high-privileged SSH access with a low-privileged key. The key-based SSH path accepts that key while selecting a different username associated with the connection's configured source IP instead of binding the key to its account. Exploitation requires valid low-privileged SSH-key access and multiple authorized-key entries sharing a host IP, after which the targeted account's privileges are granted.