cbcvebase.
CVE-2006-0230
published 2006-04-25

CVE-2006-0230: Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain…

PriorityP261critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
16.11%
96.5th percentile
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.

Affected

1 ranges
VendorProductVersion rangeFixed in
symantecantivirus_scan_engine——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<host>:8004/xml.xml↗
port8004↗
port8005↗
path/xml.xml↗
  • →Detect unauthenticated POST requests to /xml.xml on port 8004 using the Symantec Scan Engine Java applet User-Agent string, which is the attack vector used to retrieve the password hash without authentication. ↗
  • →Monitor for SSL connections to port 8005 immediately following a POST to /xml.xml on port 8004 from the same source — this two-step pattern (hash retrieval then password set) is characteristic of the exploit. ↗
  • →Alert on HTTP responses from /xml.xml containing a 64-character hexadecimal password hash in a 'pass' XML attribute, indicating successful credential disclosure. ↗
  • →Flag SSL traffic to port 8005 containing XML admin configuration change commands (e.g. 'Apply!' in response), indicating a successful password reset via the bypass. ↗
  • ·Default ports 8004 (HTTP/XML API) and 8005 (SSL admin) may be changed by the operator; detections should account for non-default port configurations. ↗
  • ·The vulnerability affects Symantec Scan Engine 5.0.0.24 and possibly other versions before 5.1.0.7; the password check is performed client-side only, so any crafted XML request bypasses authentication entirely. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.