Login Request a demo
Unscored severity · published May 10, 2006
CVE-2006-0561
Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access Control Server · Cisco
3.0; 3.0.1; 3.0.3; 3.1; 3.1.1; 3.2; +2 more · source: NVD
Affected product
SA
Secure Access Control Server
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0561
Patch
http://securitytracker.com/id?1016042
Patch
http://www.cisco.com/warp/public/707/cisco-sr-20060508-acs.shtml
www.osvdb.org
http://www.osvdb.org/25892
Vendor Advisory
http://www.securityfocus.com/archive/1/433286/100/0/threaded
Patch
http://www.securityfocus.com/archive/1/433301/100/0/threaded
Patch
http://www.securityfocus.com/bid/16743
More from Secure Access Control Server
–
CVE-2015-6349
Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject…
–
CVE-2015-6348
The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC…
–
CVE-2015-6347
The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or…
–
CVE-2015-6346
Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL
–
CVE-2015-6345
SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a…