Lucene search

[email protected]CVE-2006-0947

HistoryMar 01, 2006 - 2:02 a.m.

CVE-2006-0947

2006-03-0102:02:00

[email protected]

web.nvd.nist.gov

cve-2006-0947

thomson speedtouch

modem

firmware

remote attackers

scripting code

newuser function

user account security

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

High

0.051 Low

EPSS

Percentile

93.0%

JSON

Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the “31” parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface.

Affected configurations

NVD

Node

thomsonspeedtouchMatch516_5.3.2.6.0

thomsonspeedtouchMatch530_5.3.2.6.0

thomsonspeedtouchMatch536_5.3.2.6.0

thomsonspeedtouchMatch546_5.3.2.6.0

thomsonspeedtouchMatch576_5.3.2.6.0

thomsonspeedtouchMatch580_5.3.2.6.0

thomsonspeedtouchMatch585_5.3.2.6.0

CPENameOperatorVersion
thomson:speedtouchthomson speedtoucheq516_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq530_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq536_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq546_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq576_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq580_5.3.2.6.0
thomson:speedtouchthomson speedtoucheq585_5.3.2.6.0

CPE	Name	Operator	Version
thomson:speedtouch	thomson speedtouch	eq	516_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	530_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	536_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	546_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	576_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	580_5.3.2.6.0
thomson:speedtouch	thomson speedtouch	eq	585_5.3.2.6.0

References

secunia.com/advisories/19069

securitytracker.com/id?1015688

www.securityfocus.com/archive/1/426186

www.securityfocus.com/bid/16839

www.vupen.com/english/advisories/2006/0765

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

High

0.051 Low

EPSS

Percentile

93.0%

JSON

Related for CVE-2006-0947

nvd1 cvelist1 prion1