CVE-2006-0023

Estado: ModificadaMedia (4.3)—

Microsoft Windows XP SP1 y SP2 anteriores a agosto de 2004, y posiblemente otros sistemas operativos y versiones, usa ACLs inseguras por defecto que permiten al grupo Usuarios autentificados ganar privilegios modificando información de configuración crítica de los servicios (1) Protocolo de Descubrimiento de Servicio Simple (SSDP) y (2) 'Plug and Play' Universal (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP y (6) servicios DnsCache, tcc "DACLs de Servicios de Windows Permisivas". NOTA: Los servicios NetBT, SCardSvr, DHCP, DnsCache ya requerían acceso privilegiado para acceder a la explotación.

CVSS

Versión: 2.0
Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P
Puntuación base: 4.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.27%
Percentil entre todas las CVEs puntuadas: 69
Fecha de la puntuación: 8/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Windows XP

CWE

CWE-264

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2006-0023",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.1,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-02-08T02:18:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/18756",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://secunia.com/advisories/19238",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://secunia.com/advisories/19313",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://securitytracker.com/id?1015595",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://securitytracker.com/id?1015765",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/953860",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.microsoft.com/technet/security/advisory/914457.mspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/423587/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0417",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24463",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://secunia.com/advisories/18756",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/19238",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/19313",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1015595",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1015765",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/953860",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.microsoft.com/technet/security/advisory/914457.mspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/423587/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0417",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24463",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka \"Permissive Windows Services DACLs.\"  NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit."
    },
    {
      "lang": "es",
      "value": "Microsoft Windows XP SP1 y SP2 anteriores a agosto de 2004, y posiblemente otros sistemas operativos y versiones, usa ACLs inseguras por defecto que permiten al grupo Usuarios autentificados ganar privilegios modificando información de configuración crítica de los servicios (1) Protocolo de Descubrimiento de Servicio Simple (SSDP) y (2) 'Plug and Play' Universal (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP y (6) servicios DnsCache, tcc \"DACLs de Servicios de Windows Permisivas\". NOTA: Los servicios NetBT, SCardSvr, DHCP, DnsCache ya requerían acceso privilegiado para acceder a la explotación."
    }
  ],
  "lastModified": "2026-06-16T22:19:44.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9687E6C-EDE9-42E4-93D0-C4144FEC917A"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB2BE2DE-7B06-47ED-A674-15D45448F357"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}