CVE-2006-3109: cisco call_manager
Vulnerability summary
CVE-2006-3109 is a medium (CVSS 4.3) vulnerability in cisco call_manager. EPSS estimates a 13.73% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 21-06-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2) arbitrary parameters in ccmuser/logon.asp, aka bugid CSCsb68657.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.73%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.73% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploit Reference (fishnetsecurity.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (securitytracker.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Cisco1 product
- call_manager3.3 | 3.3\(3\) | 3.3\(3\)es61 | 3.3\(4\)es25 | 3.3\(5\) | 3.3\(5\)es30 | 3.3\(5\)sr1 | 3.3\(5\)sr2 | 4.1 | 4.1\(2\)es33 | 4.1\(2\)es55 | 4.1\(3\)es07 | 4.1\(3\)es32 | 4.1\(3\)sr1 | 4.1\(3\)sr2 | 4.1\(3\)sr3 | 4.2 | 4.2\(1\) | 4.2\(2\) | 4.3 | 4.3\(1\)
1 vendor · 1 product
References
13 links- www.fishnetsecurity.com/csirt/disclosure/cisco/Cisco+CallManager+XSS+Advisory.htmX Refsource MISCExploit
- www.cisco.com/en/US/products/sw/voicesw/ps556/tsd_products_security_response09186a00806c0846.htmlVendor AdvisoryX Refsource CISCOPatch