CVE-2006-6614
Status: ModifiedLow (1.9)—
The save_log_local function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash.
CVSS
- Version: 2.0
- Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
- Base score: 1.9
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.42%
- Percentile among all scored CVEs: 34
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- NVD-CWE-Other
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644
- http://secunia.com/advisories/23330
- http://www.securityfocus.com/bid/21579
- http://www.vupen.com/english/advisories/2006/4995
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30892
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644
- http://secunia.com/advisories/23330
- http://www.securityfocus.com/bid/21579
- http://www.vupen.com/english/advisories/2006/4995
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30892
Raw JSON (NVD)
Show
{
"id": "CVE-2006-6614",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 1.9,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.4,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2006-12-18T02:28:00.000",
"references": [
{
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/23330",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/21579",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2006/4995",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30892",
"source": "cve@mitre.org"
},
{
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/23330",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/21579",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2006/4995",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30892",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The save_log_local function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash."
},
{
"lang": "es",
"value": "La función save_log_local en Fully Automatic Installation (FAI) 2.10.1, y posiblemente 3.1.2, cuando el modo verbose está activado, almacena el hash de la contraseña de root en /var/log/fai/current/fai.log, cuyos permisos de fichero permite que sea copiado a otros host cuando fai-savelog es llamado y permite a un atacante remoto obtener el hash."
}
],
"lastModified": "2026-06-16T22:33:28.127",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thomas_lange:fully_automated_installation:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D98C8162-EA66-409E-805C-CC3B52419A7A"
},
{
"criteria": "cpe:2.3:a:thomas_lange:fully_automated_installation:3.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0004CA8D-D63F-4726-A48D-EDD696E5D1FE"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2E0C1F8-31F5-4F61-9DF7-E49B43D3C873"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BF84240-1881-4EFB-BB2F-F9CE8AD09C7B"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF8AE8C4-810F-41AB-A251-5A2D4DD6884D"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EACF214-FA27-44FF-A431-927AB79377A1"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2B58895-0E2A-4466-9CB2-0083349A83B2"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03F8220A-9B1C-40AA-AEAB-F9A93225FBD5"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2311919C-7864-469D-B0F6-9B11D8D0A1C3"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19876495-4C1A-487C-955A-C5AA46362A1F"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D75286DD-50BC-4B72-8AC8-E20730124DC2"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1998C972-497E-4916-B50E-FB32303EEA8E"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6CD3DD9-3A8A-4716-A2D1-136A790AFF94"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CE2020A-4FB2-4FCD-8561-7BD147CD95EB"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08E90AFA-C262-46D0-B60E-26B67C9602D5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}