Skip to content
Fencer Vulns
medium 6.5

CVE-2006-0705 json

Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNI…

published 2006-02-15 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0712

cvss
6.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.2%
EPSS 10.2% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3 build 35, (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8, (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0, and (6) SSH Shell Server 3.2.9 and earlier, allows remote authenticated users to execute arbitrary commands via unspecified vectors, involving crafted filenames and the stat command.

Patch / fix

Exploit prediction

10.16% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.