CVE-2006-4266: symantec norton_personal_firewall
Vulnerability summary
CVE-2006-4266 is a low (CVSS 3.6) vulnerability in symantec norton_personal_firewall. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.
Timeline
- 21-08-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using RegSaveKey and RegRestoreKey to modify HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners, as demonstrated using NISProd.dll. NOTE: in most cases, this attack would not cross privilege boundaries, because modifying the SuiteOwners key requires administrative privileges. However, this issue is a vulnerability because the product's functionality is intended to protect against privileged actions such as this.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Symantec1 product
- norton_personal_firewall≤ 2006_9.1.0.33
1 vendor · 1 product