PT-2006-4470 · Cisco · Cisco Router Web Setup+1

Published 2006-07-14 · Updated 2017-10-11 · CVE-2006-3595

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Router Web Setup (CRWS) versions prior to 3.3.0 build 31

Description The issue concerns the default configuration of the IOS HTTP server in CRWS, which does not require credentials. This allows remote attackers to access the server with arbitrary privilege levels.

Recommendations For versions prior to 3.3.0 build 31, update to version 3.3.0 build 31 or later to resolve the issue.

Fix

Related Identifiers

CVE-2006-3595

Affected Products

Cisco Router Web Setup

Ios Http Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-3595 · Security Note
• http://secunia.com/advisories/21028 · Vendor Advisory
• http://securityfocus.com/bid/18953 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27688 · Note
• http://kb.cert.org/vuls/id/205225 · Note
• http://securitytracker.com/id?1016476 · Note
• http://cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml · Patch, Vendor Advisory
• http://osvdb.org/27159 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5826 · Note
• http://vupen.com/english/advisories/2006/2773 · Note