CVE-2006-1961

Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/19736	Patch Vendor Advisory
http://secunia.com/advisories/19739
http://secunia.com/advisories/19741
http://securitytracker.com/id?1015965	Patch
http://www.assurance.com.au/advisories/200604-cisco.txt
http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml	Patch
http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml	Patch
http://www.osvdb.org/24813
http://www.securityfocus.com/archive/1/431367/30/5490/threaded
http://www.securityfocus.com/archive/1/431371/30/5490/threaded
http://www.securityfocus.com/bid/17609
http://www.vupen.com/english/advisories/2006/1434
http://www.vupen.com/english/advisories/2006/1435
https://exchange.xforce.ibmcloud.com/vulnerabilities/25884
http://secunia.com/advisories/19736	Patch Vendor Advisory
http://secunia.com/advisories/19739
http://secunia.com/advisories/19741
http://securitytracker.com/id?1015965	Patch
http://www.assurance.com.au/advisories/200604-cisco.txt
http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml	Patch
http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml	Patch
http://www.osvdb.org/24813
http://www.securityfocus.com/archive/1/431367/30/5490/threaded
http://www.securityfocus.com/archive/1/431371/30/5490/threaded
http://www.securityfocus.com/bid/17609
http://www.vupen.com/english/advisories/2006/1434
http://www.vupen.com/english/advisories/2006/1435
https://exchange.xforce.ibmcloud.com/vulnerabilities/25884

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:user_registration_tool::::::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.0:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.0::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.1:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.1::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.2:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.2::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.3:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.3::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.4:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.4::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.5:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.5::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.6:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.6::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.7:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.7::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.8:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.8::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.9:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.9::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.10:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.10::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.11:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.11::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.12:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.12::express:::::
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.13:::::::*
	cpe:2.3:a:cisco:wireless_lan_solution_engine:2.13::express:::::

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:ciscoworks_2000_service_management_solution::::::::
	cpe:2.3:h:cisco:hosting_solution_engine:1.7:::::::*
	cpe:2.3:h:cisco:hosting_solution_engine:1.7.0:::::::*
	cpe:2.3:h:cisco:hosting_solution_engine:1.7.1:::::::*
	cpe:2.3:h:cisco:hosting_solution_engine:1.7.2:::::::*
	cpe:2.3:h:cisco:hosting_solution_engine:1.7.3:::::::*
	cpe:2.3:o:cisco:ethernet_subscriber_solution_engine::::::::

History

21 Nov 2024, 00:10

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/19736 - Patch, Vendor Advisory~~	() http://secunia.com/advisories/19736 - Patch, Vendor Advisory
References	~~() http://secunia.com/advisories/19739 -~~	() http://secunia.com/advisories/19739 -
References	~~() http://secunia.com/advisories/19741 -~~	() http://secunia.com/advisories/19741 -
References	~~() http://securitytracker.com/id?1015965 - Patch~~	() http://securitytracker.com/id?1015965 - Patch
References	~~() http://www.assurance.com.au/advisories/200604-cisco.txt -~~	() http://www.assurance.com.au/advisories/200604-cisco.txt -
References	~~() http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml - Patch~~	() http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml - Patch
References	~~() http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml - Patch~~	() http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml - Patch
References	~~() http://www.osvdb.org/24813 -~~	() http://www.osvdb.org/24813 -
References	~~() http://www.securityfocus.com/archive/1/431367/30/5490/threaded -~~	() http://www.securityfocus.com/archive/1/431367/30/5490/threaded -
References	~~() http://www.securityfocus.com/archive/1/431371/30/5490/threaded -~~	() http://www.securityfocus.com/archive/1/431371/30/5490/threaded -
References	~~() http://www.securityfocus.com/bid/17609 -~~	() http://www.securityfocus.com/bid/17609 -
References	~~() http://www.vupen.com/english/advisories/2006/1434 -~~	() http://www.vupen.com/english/advisories/2006/1434 -
References	~~() http://www.vupen.com/english/advisories/2006/1435 -~~	() http://www.vupen.com/english/advisories/2006/1435 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/25884 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/25884 -

Information

Published : 2006-04-21 10:02

Updated : 2025-04-03 01:03

NVD link : CVE-2006-1961

Mitre link : CVE-2006-1961

CVE.ORG link : CVE-2006-1961

JSON object : View

Products Affected

cisco

user_registration_tool
ciscoworks_2000_service_management_solution
ethernet_subscriber_solution_engine
hosting_solution_engine
wireless_lan_solution_engine

CWE

NVD-CWE-Other

{"id": "CVE-2006-1961", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-04-21T10:02:00.000", "references": [{"url": "http://secunia.com/advisories/19736", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/19739", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/19741", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1015965", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.assurance.com.au/advisories/200604-cisco.txt", "source": "cve@mitre.org"}, {"url": "http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/24813", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/431367/30/5490/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/431371/30/5490/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/17609", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1434", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1435", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25884", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/19736", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/19739", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/19741", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1015965", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.assurance.com.au/advisories/200604-cisco.txt", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/24813", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/431367/30/5490/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/431371/30/5490/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/17609", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/1434", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/1435", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25884", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the \"show\" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:user_registration_tool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "441C9430-C57D-48F5-8C6F-B64759ED5777"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E89560E-5A06-44F5-82AB-AEB9AD7B97DD"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.0:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBF2B953-773A-4E47-9EEA-4826354650EE"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D54C89F2-D5F5-412D-85C6-1CD76E03BE26"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.1:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AA97244-E7A9-49A2-9414-E5860AF3611D"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E013901C-1B1E-4839-867B-D647A996BF60"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.2:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "055B35BB-602A-4C26-A0D4-6614D1B09A97"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B228B395-6964-449D-9B09-D7BFE31E9851"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.3:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5344233-E08D-4066-86CD-D9D9B84B039D"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25B36A82-33BE-4BA4-9B4A-36D685607A4C"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.4:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "337C5C2C-2A2C-4C94-9DBF-2BB795BEEF1A"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3D72DCA-130D-4507-BDAC-A6183D08BC2E"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.5:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AAF32A3-4D70-4E1A-9FBE-A465F3910B57"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87C22C0D-2E74-44B8-BAF1-FACBE7B7A497"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.6:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BD43E20-9E43-46FB-952A-EE181D87F116"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BB965A0-7FB2-4DF7-82C8-D0AB4E8AE4CA"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.7:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A5BDD7D-7321-4061-9E43-3DB613768945"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6C66F51-37FC-4CEF-A532-17522EE32BAD"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.8:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6EA38AC-8E50-45FF-8F17-C679E165269D"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F560405-DD99-4D09-9D9B-19F88A63C689"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.9:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27C389A3-27DC-4EAB-A08C-60BF1774351B"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBBAC34E-4572-48D2-B7B5-5AB623A35A42"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.10:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35CFCBC7-68A8-407D-9983-FBA414318880"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CA72C62-7004-4A5C-BEA5-5ACA55279366"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.11:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C6865FB-479A-41F0-89ED-BF02E80D9FDB"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ADEEA82-4371-4D25-8CEB-F6F8B32ED9F4"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.12:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF202456-0666-4DBB-8918-B30B83850201"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC9515C2-5549-4EBC-8FF1-8C75E92794D2"}, {"criteria": "cpe:2.3:a:cisco:wireless_lan_solution_engine:2.13:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D994D17-087E-450B-A5DE-F56949717C6C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:ciscoworks_2000_service_management_solution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10CAB6F5-563C-4E8A-B769-45B1981BADF5"}, {"criteria": "cpe:2.3:h:cisco:hosting_solution_engine:1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9405E712-6682-4DCE-AA18-311A2D6AA958"}, {"criteria": "cpe:2.3:h:cisco:hosting_solution_engine:1.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDA1DA2E-FD49-46B1-96E0-1129B16A8DD6"}, {"criteria": "cpe:2.3:h:cisco:hosting_solution_engine:1.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D44C3E02-A17C-48A2-8173-358570C2ACAB"}, {"criteria": "cpe:2.3:h:cisco:hosting_solution_engine:1.7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DA04953-EBE5-482D-83F9-30F10F739C31"}, {"criteria": "cpe:2.3:h:cisco:hosting_solution_engine:1.7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADE85A5A-2CF3-49FB-A15C-49EA56338FBB"}, {"criteria": "cpe:2.3:o:cisco:ethernet_subscriber_solution_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6290FDDC-8965-4045-900E-933D85511F67"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

7.5 /10