Critical Published: May 10, 2007 Modified: Apr 09, 2025

CVE-2007-2586

9.3 CVSS Score Critical

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Export CVE-2007-2586 Data:

Link copied!

Description

The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.

CVSS Vector Details

Attack Vector Network

Attack Complexity M

Confidentiality C

Integrity C

Availability C

Affected Software Configurations

o cisco ios 12.0\(1\)t * * * * * * *
o cisco ios 12.0\(1\)t1 * * * * * * *
o cisco ios 12.0\(1\)xe * * * * * * *
o cisco ios 12.0\(2\)s * * * * * * *
o cisco ios 12.0\(2\)t * * * * * * *
o cisco ios 12.0\(2\)t1 * * * * * * *
o cisco ios 12.0\(2\)xe * * * * * * *
o cisco ios 12.0\(2\)xe1 * * * * * * *
o cisco ios 12.0\(2\)xe3 * * * * * * *
o cisco ios 12.0\(2\)xe4 * * * * * * *

Weaknesses (CWE)

CWE-863

References & External Links

External Resources

NVD Official Record Exploit-DB Search Exploits CVE Details Statistics GitHub PoC / Tools X / Twitter Discussions Google Search More

← Back to CVE Tracker