Description
The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.
References (9)
Core 9
Core References
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/205225
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1016476
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27688
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/18953
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/27159
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/21028
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2773
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5826
Patch vendor-advisory
x_refsource_cisco
http://www.cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml
Scores
EPSS
0.0421
EPSS Percentile
89.9%
Details
Status
published
Products (1)
cisco/router_web_setup
3.3.0_build_30
Published
Jul 18, 2006
Tracked Since
Feb 18, 2026