CVE-2006-3291 in the critical feed json
The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itsel…
published 2006-06-28 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3288
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.8%
- EPSS 3.8% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password configurations and allows remote attackers to access the system.
Patch / fix
Exploit prediction
3.81% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-16 Configuration
- Technology feeds
References
-
cisco.com
/warp/public/707/cisco-sa-20060628-ap.shtml
vendor-advisory, patch
-
securityfocus.com
/bid/18704
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/27437
vdb-entry
-
osvdb.org
/26878
vdb-entry
-
securitytracker.com
/id?1016399
vdb-entry
-
vupen.com
/english/advisories/2006/2584
vdb-entry
-
kb.cert.org
/vuls/id/544484
third-party-advisory, us-government-resource
-
secunia.com
/advisories/20860
third-party-advisory
Sources
- CVE List CVE-2006-3291
- NVD CVE-2006-3291
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.