Vulnerability Details : CVE-2006-0561
Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.
Products affected by CVE-2006-0561
- cpe:2.3:a:cisco:secure_access_control_server:3.0.1:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.2:*:windows_server:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.1.1:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.0:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.0.3:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.1:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.2:*:windows_nt:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_server:3.3:*:windows_nt:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-0561
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-0561
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
References for CVE-2006-0561
-
http://www.cisco.com/warp/public/707/cisco-sr-20060508-acs.shtml
Patch
-
http://www.securityfocus.com/archive/1/433301/100/0/threaded
Patch;Vendor Advisory
-
http://securitytracker.com/id?1016042
Patch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/26307
-
http://www.vupen.com/english/advisories/2006/1741
-
http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt
Patch;Vendor Advisory
-
http://www.securityfocus.com/archive/1/433286/100/0/threaded
Vendor Advisory
-
http://www.securityfocus.com/bid/16743
Patch
Jump to