CVE-2006-3073
Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.
Key facts
- CVSS score
- 2.6 (v2.0)
- Severity
- LOW
- CVSS vector
AV:N/AC:H/Au:N/C:N/I:P/A:N- EPSS score
- 1.7% (77th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2006-3070)
- Published
- June 19, 2006
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2006-3070 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- cisco / asa 5500
- cisco / asa 5500
- cisco / asa 5500
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
- cisco / vpn 3000 concentrator series software
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Cisco FTD (NGFW) 7.0 on ASA 5500 and ISA 3000 and FTDv with FMC/FMCv - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11300-2023 - archived
- VPN 3000 Concentrator Series - Cisco Systems, Inc. - FIPS 140 210 - historical
References
- http://secunia.com/advisories/20644(Vendor Advisory)
- http://securitytracker.com/id?1016252(Exploit)
- http://www.cisco.com/warp/public/707/cisco-sr-20060613-webvpn-xss.shtml
- http://www.osvdb.org/26453
- http://www.osvdb.org/26454
- http://www.securityfocus.com/archive/1/436479/30/0/threaded
- http://www.securityfocus.com/bid/18419
- http://www.vupen.com/english/advisories/2006/2331
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27086
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain