This article incorrectly refers to ACS as a firewall system. ACS is used primarily to control management access to Network Devices via TACACS+ or RADIUS. It off

This article incorrectly refers to ACS as a firewall system. ACS is used primarily to control management access to Network Devices via TACACS+ or RADIUS. It offers no firewall functionality whatsoever. This is arguably worse than it just being a firewall. I imagine that it wouldn't be a huge leap for someone to use this exploit to create a local account and policies to give themselves access to every router, switch, firewall and appliance in an enterprise.