CVE-2006-3425 json
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, do…
published 2006-07-07 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3421
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
Patch / fix
- securitytracker.com/id?1016405 patch
- secunia.com/advisories/20876 advisory
- secunia.com/advisories/20878 advisory
Exploit prediction
2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/20876
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/20878
third-party-advisory, patch, vendor-advisory
-
securitytracker.com
/id?1016405
vdb-entry, patch
-
lists.grok.org.uk
/pipermail/full-disclosure/2006-June/047495.html
mailing-list
-
securityfocus.com
/archive/1/438710/100/0/threaded
mailing-list
-
securityreason.com
/securityalert/1200
third-party-advisory
-
vupen.com
/english/advisories/2006/2596
vdb-entry
-
vupen.com
/english/advisories/2006/2595
vdb-entry
-
securityfocus.com
/bid/18723
vdb-entry
Sources
- CVE List CVE-2006-3425
- NVD CVE-2006-3425
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.