{"api_version":"1","generated_at":"2026-07-23T10:21:18+00:00","cve":"CVE-2006-0023","urls":{"html":"https://cve.report/CVE-2006-0023","api":"https://cve.report/api/cve/CVE-2006-0023.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0023","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0023"},"summary":{"title":"CVE-2006-0023","description":"Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka \"Permissive Windows Services DACLs.\"  NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit.","state":"PUBLISHED","assigner":"microsoft","published_at":"2006-02-08 02:18:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P","baseScore":4.3,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf","name":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"404 Not Found","mime":"application/pdf","httpstatus":"404","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/0417","name":"http://www.vupen.com/english/advisories/2006/0417","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.microsoft.com/technet/security/advisory/914457.mspx","name":"http://www.microsoft.com/technet/security/advisory/914457.mspx","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Your request has been blocked. This could be\r\n                        due to several reasons.","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS06-011 - Important | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/953860","name":"http://www.kb.cert.org/vuls/id/953860","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"US-CERT Vulnerability Note VU#953860","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1015765","name":"http://securitytracker.com/id?1015765","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Microsoft Windows Services Have Unsafe Default ACLs That Let Remote Authenticated Users Gain Elevated Privileges","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/19313","name":"http://secunia.com/advisories/19313","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Nortel Centrex IP Client Manager Windows Privilege Escalation","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1015595","name":"http://securitytracker.com/id?1015595","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Microsoft Windows UPnP/NetBT/SCardSvr/SSDP Services May Be Incorrectly Configured By 3rd Party Applications, Allowing Local Users to Gain Elevated Privileges","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/423587/100/0/threaded","name":"http://www.securityfocus.com/archive/1/423587/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm","name":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"1. Overview:","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24463","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24463","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=","name":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/18756","name":"http://secunia.com/advisories/18756","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Windows Insecure Service Permissions Privilege Escalation - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/19238","name":"http://secunia.com/advisories/19238","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Avaya Modular Messaging Windows Privilege Escalation Security Issues - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0023","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0023","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"23","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_xp","cpe6":"*","cpe7":"sp1","cpe8":"tablet_pc","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"23","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_xp","cpe6":"*","cpe7":"sp2","cpe8":"tablet_pc","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"23","cve":"CVE-2006-0023","epss":"0.007790000","percentile":"0.737040000","score_date":"2026-04-16","updated_at":"2026-04-17 00:09:25"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:18:20.702Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"19313","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/19313"},{"name":"oval:org.mitre.oval:def:1671","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671"},{"name":"1015765","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015765"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm"},{"name":"19238","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/19238"},{"name":"20060131 Windows Access Control Demystified","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/423587/100/0/threaded"},{"name":"VU#953860","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/953860"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID="},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf"},{"name":"win-auth-users-insecure-permissions(24463)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24463"},{"name":"18756","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/18756"},{"name":"MS06-011","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011"},{"name":"oval:org.mitre.oval:def:1696","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.microsoft.com/technet/security/advisory/914457.mspx"},{"name":"1015595","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015595"},{"name":"ADV-2006-0417","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0417"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-01-31T00:00:00.000Z","descriptions":[{"lang":"en","value":"Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka \"Permissive Windows Services DACLs.\"  NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-19T14:57:01.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"19313","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/19313"},{"name":"oval:org.mitre.oval:def:1671","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671"},{"name":"1015765","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015765"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm"},{"name":"19238","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/19238"},{"name":"20060131 Windows Access Control Demystified","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/423587/100/0/threaded"},{"name":"VU#953860","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/953860"},{"tags":["x_refsource_CONFIRM"],"url":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID="},{"tags":["x_refsource_MISC"],"url":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf"},{"name":"win-auth-users-insecure-permissions(24463)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24463"},{"name":"18756","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/18756"},{"name":"MS06-011","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011"},{"name":"oval:org.mitre.oval:def:1696","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696"},{"tags":["x_refsource_MISC"],"url":"http://www.microsoft.com/technet/security/advisory/914457.mspx"},{"name":"1015595","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015595"},{"name":"ADV-2006-0417","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0417"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2006-0023","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka \"Permissive Windows Services DACLs.\"  NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"19313","refsource":"SECUNIA","url":"http://secunia.com/advisories/19313"},{"name":"oval:org.mitre.oval:def:1671","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1671"},{"name":"1015765","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015765"},{"name":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm","refsource":"CONFIRM","url":"http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm"},{"name":"19238","refsource":"SECUNIA","url":"http://secunia.com/advisories/19238"},{"name":"20060131 Windows Access Control Demystified","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/423587/100/0/threaded"},{"name":"VU#953860","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/953860"},{"name":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=","refsource":"CONFIRM","url":"http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID="},{"name":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf","refsource":"MISC","url":"http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf"},{"name":"win-auth-users-insecure-permissions(24463)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24463"},{"name":"18756","refsource":"SECUNIA","url":"http://secunia.com/advisories/18756"},{"name":"MS06-011","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011"},{"name":"oval:org.mitre.oval:def:1696","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1696"},{"name":"http://www.microsoft.com/technet/security/advisory/914457.mspx","refsource":"MISC","url":"http://www.microsoft.com/technet/security/advisory/914457.mspx"},{"name":"1015595","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015595"},{"name":"ADV-2006-0417","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0417"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2006-0023","datePublished":"2006-02-08T02:00:00.000Z","dateReserved":"2005-11-30T00:00:00.000Z","dateUpdated":"2024-08-07T16:18:20.702Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-02-08 02:18:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P","baseScore":4.3,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.1,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*","matchCriteriaId":"B9687E6C-EDE9-42E4-93D0-C4144FEC917A"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*","matchCriteriaId":"FB2BE2DE-7B06-47ED-A674-15D45448F357"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"23","Ordinal":"1","Title":"CVE-2006-0023","CVE":"CVE-2006-0023","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"23","Ordinal":"1","NoteData":"Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka \"Permissive Windows Services DACLs.\"  NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit.","Type":"Description","Title":"CVE-2006-0023"},{"CveYear":"2006","CveId":"23","Ordinal":"2","NoteData":"2006-02-07","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"23","Ordinal":"3","NoteData":"2018-10-19","Type":"Other","Title":"Modified"}]}}}