Is CVE-2006-4692 being actively exploited?

CVE-2006-4692 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2006-4692?

CVE-2006-4692 has a CVSS 2.0 base score of 5.1 (MEDIUM).

CVE-2006-4692

MEDIUM · CVSS 5.1EPSS 29.7%EU EUVD

Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."

Key facts

CVSS score: 5.1 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness (CWE): CWE-88
EPSS score: 29.7% (98th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2006-4679)
Published: October 10, 2006
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2006-4679 in the EU Vulnerability Database. Last updated in EUVD on October 15, 2024.

View on the EU Vulnerability Database

Affected products

microsoft / windows server 2003
microsoft / windows server 2003
microsoft / windows xp
microsoft / windows xp

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Windows XP Enhanced Cryptographic Provider (RSAENH) - Microsoft Corporation - FIPS 140 989 - historical
Windows XP Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) - Microsoft Corporation - FIPS 140 990 - historical
Microsoft Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions; Windows XP Professional SP2 and x64 SP2; Windows XP Embedded SP2 - Microsoft Corporation - Common Criteria CCEVS-VR-VID-10184-2008 - archived
Microsoft Windows 2003 and Microsoft Windows XP - Microsoft Corporation - Common Criteria CCEVS-VR-0131-2005 - archived

References

http://secunia.com/advisories/20717(Broken Link, Vendor Advisory)
http://secunia.com/secunia_research/2006-54/advisory/(Broken Link, Vendor Advisory)
http://securitytracker.com/id?1017037(Broken Link, Third Party Advisory, VDB Entry)
http://www.kb.cert.org/vuls/id/703936(Third Party Advisory, US Government Resource)
http://www.osvdb.org/29424(Broken Link)
http://www.securityfocus.com/archive/1/448273/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/archive/1/448696/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/archive/1/449179/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/20318(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2006/3984(Broken Link, Vendor Advisory)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065(Patch, Vendor Advisory)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496(Broken Link)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain