PT-2006-4470 · Cisco · Cisco Router Web Setup+1

Publicado 2006-07-14 · Atualizado 2017-10-11 · CVE-2006-3595

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Router Web Setup (CRWS) versions prior to 3.3.0 build 31

Description The issue concerns the default configuration of the IOS HTTP server in CRWS, which does not require credentials. This allows remote attackers to access the server with arbitrary privilege levels.

Recommendations For versions prior to 3.3.0 build 31, update to version 3.3.0 build 31 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2006-3595

Produtos afetados

Cisco Router Web Setup

Ios Http Server

Referências · 10

• http://securityfocus.com/bid/18953 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27688 · Nota
• http://kb.cert.org/vuls/id/205225 · Nota
• http://securitytracker.com/id?1016476 · Nota
• http://cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml · Correção, Aviso do Fabricante
• http://osvdb.org/27159 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3595 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5826 · Nota
• http://vupen.com/english/advisories/2006/2773 · Nota
• http://secunia.com/advisories/21028 · Aviso do Fabricante