Skip to content
Fencer Vulns
high 7.5

CVE-2006-0947 json

Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in th…

published 2006-03-01 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0950

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
1
Exploit-DB

Summary

Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface.

Timeline

  1. First public exploit (EDB-27319)
  2. Published

Exploit prediction

2.69% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-27319 Thomson SpeedTouch 500 Series - NewUser Function 31 Variable Persistent User Creation remote, 2006-02-25
  • securityfocus.com http://www.securityfocus.com/bid/16839 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/426186 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.