Login Request a demo
Unscored severity · published Nov 8, 2006
CVE-2006-5806
SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a…
–
CVSS
0.3%
EPSS
No
On KEV
Description
SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of the CSD vault and does not restrict the user from saving files outside of the vault, which is not cleared after the VPN connection terminates and allows local users to read unencrypted data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Desktop · Cisco
through 3.1.1.33 · source: NVD
Affected product
SD
Secure Desktop
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5806
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5806
secunia.com
http://secunia.com/advisories/22747
securitytracker.com
http://securitytracker.com/id?1017195
Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml
www.osvdb.org
http://www.osvdb.org/30306
www.securityfocus.com
http://www.securityfocus.com/bid/20964
www.vupen.com
http://www.vupen.com/english/advisories/2006/4409
More from Secure Desktop
5.5
CVE-2006-5393
Cisco Secure Desktop (CSD) does not require that the ClearPageFileAtShutdown (aka CCE-Winv2.0-407) registry value equals 1, which might allow local users to read certain memory…
–
CVE-2015-0691
A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID…
–
CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to…
–
CVE-2012-2495
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of…
–
CVE-2011-0925
The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine,…