CVE-2006-4887 json
Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applicatio…
published 2006-09-19 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-4874
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applications, which allows local users to bypass authentication and gain privileges by selecting the icon during installation. NOTE: it could be argued that the issue is not in Remote Desktop itself, but in applications that are installed while using it.
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/20092
vdb-entry
-
securityfocus.com
/archive/1/446371/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/446751/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/447043/100/0/threaded
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/29060
vdb-entry
-
osvdb.org
/32260
vdb-entry
Sources
- CVE List CVE-2006-4887
- NVD CVE-2006-4887
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.