Medium severity · published Jan 27, 2020
CVE-2006-7246
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used
6.8
CVSS
0.9%
EPSS
No
On KEV
Description
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Linux Enterprise Desktop · Suse
11 · source: NVD
LE
Linux Enterprise Server · Suse
11 · source: NVD
NE
Networkmanager · Gnome
0.9.0 through 0.9.9.98 · source: NVD
OP
Opensuse · Opensuse
11.3; 11.4; 12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-7246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-7246
Mailing List
http://www.openwall.com/lists/oss-security/2010/04/22/2
Exploit
https://bugzilla.gnome.org/show_bug.cgi?id=341323
Exploit
https://bugzilla.novell.com/show_bug.cgi?id=574266
Exploit
https://lwn.net/Articles/468868/
More from Networkmanager
7.5
CVE-2018-1000135
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local…
5.5
CVE-2021-20297
A flaw was found in NetworkManager in versions before 1.30.0
5.5
CVE-2012-1096
NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection
4.4
CVE-2012-2736
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network
4.3
CVE-2020-10754
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile