CVE-2006-3595 The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary priv...
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco router web setup | = 3.3.0_build_30 | No fix listed |
References
- 21028 third-party-advisory vendor-advisory
- 1016476 vdb-entry
- 20060712 Cisco Router Web Setup Ships with Insecure Default IOS Configuration patch vendor-advisory
- VU#205225 third-party-advisory us-government-resource
- 27159 vdb-entry
- 18953 vdb-entry
- ADV-2006-2773 vdb-entry
- cisco-crws-command-execution(27688) vdb-entry
- oval:org.mitre.oval:def:5826 signature vdb-entry