Seems Cisco VPN concentrators can be played with over FTP. Why anyone would want to allow FTP to their VPN concentrator escapes me though. See http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml
Another one you sure are also going to like is a Cisco advisory with a truly lovely title. They call it "Unintentional Password Modification Vulnerability in Cisco Firewall Products". I wonder if there is a vulnerability that allows intentional password modification. Or an unintentional feature that allows the same. But oh well: http://www.cisco.com/warp/public/707/cisco-sa-20060823-firewall.shtml has the details of an apparently rare glitch that can make PIXes and ASAs lose their EXEC password.