CVE-2006-3595

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-18 · updated 2026-06-16

Description

The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.

Affected products

Cisco Router Web Setup: 3.3.0_build_30

References

http://secunia.com/advisories/21028
http://securitytracker.com/id?1016476
http://www.cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml
http://www.kb.cert.org/vuls/id/205225
http://www.osvdb.org/27159
http://www.securityfocus.com/bid/18953
http://www.vupen.com/english/advisories/2006/2773
https://exchange.xforce.ibmcloud.com/vulnerabilities/27688
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5826
http://secunia.com/advisories/21028
http://securitytracker.com/id?1016476
http://www.cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml

Get alerted when CVE-2006-3595 or the next vulnerability affects your stack