PT-2006-4185 · Cisco · Cisco Ios

Published 2006-06-28 · Updated 2017-07-20 · CVE-2006-3291

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.3(8)JA and 12.3(8)JA1

Description The issue affects the web interface of Cisco IOS, specifically when the setting is changed to use the "Local User List Only (Individual Passwords)" option. This change causes the removal of all security and password configurations, allowing remote attackers to access the system.

Recommendations For Cisco IOS version 12.3(8)JA, avoid using the "Local User List Only (Individual Passwords)" setting until a fix is available. For Cisco IOS version 12.3(8)JA1, avoid using the "Local User List Only (Individual Passwords)" setting until a fix is available. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2006-3291

Affected Products

Cisco Ios

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-3291 · Security Note
• http://secunia.com/advisories/20860 · Note
• http://kb.cert.org/vuls/id/544484 · Note
• http://securityfocus.com/bid/18704 · Note
• http://cisco.com/warp/public/707/cisco-sa-20060628-ap.shtml · Patch, Vendor Advisory
• http://securitytracker.com/id?1016399 · Note
• http://vupen.com/english/advisories/2006/2584 · Note
• http://osvdb.org/26878 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27437 · Note