low
2.6
CWE
NVD-CWE-Other 79
Advisory Published
Updated

CVE-2006-3073: XSS

First published: Mon Jun 19 2006(Updated: )

Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Cisco ASA 5500 CSC-SSM=7.0
Cisco ASA 5500 CSC-SSM=7.0\(4\)
Cisco ASA 5500 CSC-SSM=7.0.4.3
Cisco VPN 3000 concentrator series software=2.0
Cisco VPN 3000 concentrator series software=2.5.2.a
Cisco VPN 3000 concentrator series software=2.5.2.b
Cisco VPN 3000 concentrator series software=2.5.2.c
Cisco VPN 3000 concentrator series software=2.5.2.d
Cisco VPN 3000 concentrator series software=2.5.2.f
Cisco VPN 3000 concentrator series software=3.0
Cisco VPN 3000 concentrator series software=3.0.3.a
Cisco VPN 3000 concentrator series software=3.0.3.b
Cisco VPN 3000 concentrator series software=3.0.4
Cisco VPN 3000 concentrator series software=3.1
Cisco VPN 3000 concentrator series software=3.1\(rel\)
Cisco VPN 3000 concentrator series software=3.1.1
Cisco VPN 3000 concentrator series software=3.1.2
Cisco VPN 3000 concentrator series software=3.1.4
Cisco VPN 3000 concentrator series software=3.5\(rel\)
Cisco VPN 3000 concentrator series software=3.5.1
Cisco VPN 3000 concentrator series software=3.5.2
Cisco VPN 3000 concentrator series software=3.5.3
Cisco VPN 3000 concentrator series software=3.5.4
Cisco VPN 3000 concentrator series software=3.5.5
Cisco VPN 3000 concentrator series software=3.6
Cisco VPN 3000 concentrator series software=3.6.1
Cisco VPN 3000 concentrator series software=3.6.7
Cisco VPN 3000 concentrator series software=3.6.7d
Cisco VPN 3000 concentrator series software=4.0
Cisco VPN 3000 concentrator series software=4.0.1
Cisco VPN 3000 concentrator series software=4.0.5.b
Cisco VPN 3000 concentrator series software=4.1
Cisco VPN 3000 concentrator series software=4.1.5.b
Cisco VPN 3000 concentrator series software=4.1.7.a
Cisco VPN 3000 concentrator series software=4.1.7.b
Cisco VPN 3000 concentrator series software=4.7
Cisco VPN 3000 concentrator series software=4.7.1
Cisco VPN 3000 concentrator series software=4.7.1.f

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2006-3073?

    CVE-2006-3073 has a severity rating of medium due to its potential to facilitate cross-site scripting attacks.

  • How do I fix CVE-2006-3073?

    To fix CVE-2006-3073, update the affected Cisco VPN 3000 Series Concentrators and ASA 5500 Series to the latest software version.

  • What systems are affected by CVE-2006-3073?

    CVE-2006-3073 affects Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series in WebVPN clientless mode.

  • Can CVE-2006-3073 lead to data breaches?

    Yes, CVE-2006-3073 can lead to data breaches if attackers successfully exploit the XSS vulnerabilities.

  • What information can be leaked due to CVE-2006-3073?

    Exploitation of CVE-2006-3073 may allow attackers to inject arbitrary scripts, potentially leading to the leakage of sensitive user data.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203