Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.
- http://www.cisco.com/warp/public/707/cisco-sa-20060111-mars.shtml
No PoCs found on GitHub currently.