Vulnerability Details : CVE-2006-3209
The Task scheduler (at.exe) on Microsoft Windows XP spawns each scheduled process with SYSTEM permissions, which allows local users to gain privileges. NOTE: this issue has been disputed by third parties, who state that the Task scheduler is limited to the Administrators group by default upon installation
Exploit prediction scoring system (EPSS) score for CVE-2006-3209
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2006-3209
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
References for CVE-2006-3209
-
http://www.securityfocus.com/archive/1/436810/100/200/threaded
-
http://www.securityfocus.com/archive/1/436884/100/200/threaded
-
http://securityreason.com/securityalert/1137
Windows XP Task Scheduler Local Privilege Escalation (Advisory) - CXSecurity.com
Products affected by CVE-2006-3209
- cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*