CVE-2006-1961

Description

Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 1.31% Top 25%

Vendor Advisory cisco.com Vendor Advisory cisco.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.osvdb.org/24813	vdb entry
http://www.vupen.com/english/advisories/2006/1435	vdb entry
http://www.securityfocus.com/bid/17609	vdb entry
http://www.assurance.com.au/advisories/200604-cisco.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/25884	vdb entry
http://www.securityfocus.com/archive/1/431371/30/5490/threaded	mailing list
http://secunia.com/advisories/19736	third party advisory patch vendor advisory
http://www.securityfocus.com/archive/1/431367/30/5490/threaded	mailing list
http://secunia.com/advisories/19739	third party advisory
http://www.vupen.com/english/advisories/2006/1434	vdb entry
http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml	patch vendor advisory
http://secunia.com/advisories/19741	third party advisory
http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml	patch vendor advisory
http://securitytracker.com/id?1015965	vdb entry patch

Frequently Asked Questions

What is the severity of CVE-2006-1961?: CVE-2006-1961 has been scored as a high severity vulnerability.
How to fix CVE-2006-1961?: To fix CVE-2006-1961, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-1961 being actively exploited in the wild?: It is possible that CVE-2006-1961 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.