Unscored severity · published Oct 29, 2010
CVE-2010-3036
Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary…
–
CVSS
6%
EPSS
No
On KEV
Description
Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Ciscoworks Common Services · Cisco
3.0.5; 3.0.6; 3.1; 3.1.1; 3.2; 3.3 · source: NVD
CL
Ciscoworks Lan Management Solution · Cisco
2.6; 3.0; 3.0; 3.1; 3.2 · source: NVD
QP
Qos Policy Manager · Cisco
4.0; 4.0.1; 4.0.2 · source: NVD
SM
Security Manager · Cisco
3.0.2; 3.2 · source: NVD
TR
Telepresence Readiness Assessment Manager · Cisco
1.0 · source: NVD
UO
Unified Operations Manager · Cisco
2.0.1; 2.0.2; 2.0.3 · source: NVD
US
Unified Service Monitor · Cisco
2.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3036
osvdb.org
http://osvdb.org/68927
Vendor Advisory
http://secunia.com/advisories/42011
securitytracker.com
http://securitytracker.com/id?1024646
Patch
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b51501.shtml
Patch
http://www.securityfocus.com/bid/44468
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2793
More from Ciscoworks Common Services
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2011-4237
CRLF injection vulnerability in autologin.jsp in Cisco CiscoWorks Common Services 4.0, as used in Cisco Prime LAN Management Solution and other products, allows remote attackers…
–
CVE-2011-2042
The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the…
–
CVE-2011-3310
The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service…
–
CVE-2011-0966
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read…